From e2e782a0f7a20045080514e3dc2a33301219d4a8 Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Fri, 22 Sep 2017 10:53:59 -0700
Subject: [PATCH 01/25] Use package status instead of deleted bit (#4665)

Address https://github.com/NuGet/NuGetGallery/issues/4645
---
 .../AuditedEntities/AuditedPackage.cs         |  6 +-
 src/NuGetGallery.Core/Entities/Package.cs     |  1 +
 src/NuGetGallery.Core/SemVerLevelKey.cs       | 57 ++++++++++++++++---
 .../Admin/Controllers/DeleteController.cs     |  2 +-
 .../Controllers/ODataV1FeedController.cs      | 16 +++---
 .../ODataV2CuratedFeedController.cs           |  6 +-
 .../Controllers/ODataV2FeedController.cs      | 24 ++++----
 .../Lucene/LuceneIndexingService.cs           |  8 ++-
 .../OData/SearchService/SearchAdaptor.cs      |  2 +-
 ...utoCompleteDatabasePackageVersionsQuery.cs |  4 +-
 .../Services/PackageDeleteService.cs          |  2 +
 .../PackageNamingConflictValidator.cs         |  3 +-
 src/NuGetGallery/Services/PackageService.cs   | 32 +++++++----
 .../ViewModels/PackageViewModel.cs            |  2 +-
 .../Auditing/AuditingServiceTests.cs          |  8 ++-
 .../SemVerLevelKeyFacts.cs                    | 22 ++++++-
 .../Services/FeedServiceFacts.cs              | 14 ++---
 .../Services/PackageDeleteServiceFacts.cs     |  4 ++
 .../PackageNamingConflictValidatorFacts.cs    |  4 +-
 .../Services/PackageServiceFacts.cs           |  8 ++-
 .../Infrastructure/FeedServiceHelpers.cs      |  2 +-
 21 files changed, 162 insertions(+), 65 deletions(-)

diff --git a/src/NuGetGallery.Core/Auditing/AuditedEntities/AuditedPackage.cs b/src/NuGetGallery.Core/Auditing/AuditedEntities/AuditedPackage.cs
index b3f272c684..1cecaf5384 100644
--- a/src/NuGetGallery.Core/Auditing/AuditedEntities/AuditedPackage.cs
+++ b/src/NuGetGallery.Core/Auditing/AuditedEntities/AuditedPackage.cs
@@ -44,6 +44,7 @@ public class AuditedPackage
         public int? UserKey { get; private set; }
         public bool Deleted { get; private set; }
         public bool HasReadMe { get; private set; }
+        public int PackageStatusKey { get; private set; }
 
         public static AuditedPackage CreateFrom(Package package)
         {
@@ -83,8 +84,11 @@ public static AuditedPackage CreateFrom(Package package)
                 Key = package.Key,
                 MinClientVersion = package.MinClientVersion,
                 UserKey = package.UserKey,
+#pragma warning disable CS0612 // Type or member is obsolete
                 Deleted = package.Deleted,
-                HasReadMe = package.HasReadMe
+#pragma warning restore CS0612 // Type or member is obsolete
+                HasReadMe = package.HasReadMe,
+                PackageStatusKey = (int)package.PackageStatusKey,
             };
         }
     }
diff --git a/src/NuGetGallery.Core/Entities/Package.cs b/src/NuGetGallery.Core/Entities/Package.cs
index 32cb658bc9..14aaaedf83 100644
--- a/src/NuGetGallery.Core/Entities/Package.cs
+++ b/src/NuGetGallery.Core/Entities/Package.cs
@@ -223,6 +223,7 @@ public bool HasReadMe {
         /// </summary>
         public virtual ICollection<PackageHistory> PackageHistories { get; set; }
 
+        [Obsolete]
         public bool Deleted { get; set; }
 
         /// <summary>
diff --git a/src/NuGetGallery.Core/SemVerLevelKey.cs b/src/NuGetGallery.Core/SemVerLevelKey.cs
index 8010e0f76c..d69b753f5b 100644
--- a/src/NuGetGallery.Core/SemVerLevelKey.cs
+++ b/src/NuGetGallery.Core/SemVerLevelKey.cs
@@ -8,17 +8,48 @@
 
 namespace NuGetGallery
 {
-    // Hard-coded for now, but we can easily expand to use an additional Sql table to join with 
-    // when supporting additional semVerLevel's is needed.
-
     /// <summary>
     /// Helper class to use to determine the SemVer level of a package version.
     /// </summary>
     public static class SemVerLevelKey
     {
-        public static readonly string SemVerLevel2 = "2.0.0";
+        public const string SemVerLevel2 = "2.0.0";
         private static readonly NuGetVersion _semVer2Version = NuGetVersion.Parse(SemVerLevel2);
 
+        /// <summary>
+        /// Since <see cref="Unknown"/> is not a constant, we must explicitly construct the expression to force
+        /// that value to be considered a constant. If <see cref="Unknown"/> is not considered a constant, the
+        /// expression that is converted to SQL by Entity Framework is less efficient.
+        /// </summary>
+        private static readonly Lazy<Expression<Func<Package, bool>>> _isUnknown = new Lazy<Expression<Func<Package, bool>>>(() =>
+        {
+            var parameter = Expression.Parameter(typeof(Package), "p");
+            var property = Expression.Property(parameter, nameof(Package.SemVerLevelKey));
+            return Expression.Lambda<Func<Package, bool>>(
+                Expression.Equal(
+                    property,
+                    Expression.Constant(Unknown)),
+                parameter);
+        });
+
+        private static readonly Lazy<Expression<Func<Package, bool>>> _isSemVer2 = new Lazy<Expression<Func<Package, bool>>>(() =>
+        {
+            /// Since <see cref="Unknown"/> is not a constant, we must explicitly construct the expression to force
+            /// that value to be considered a constant. If <see cref="Unknown"/> is not considered a constant, the
+            /// expression that is converted to SQL by Entity Framework is less efficient.
+            var parameter = Expression.Parameter(typeof(Package), "p");
+            var property = Expression.Property(parameter, nameof(Package.SemVerLevelKey));
+            return Expression.Lambda<Func<Package, bool>>(
+                Expression.Or(
+                    Expression.Equal(
+                        property,
+                        Expression.Constant(Unknown)),
+                    Expression.Equal(
+                        property,
+                        Expression.Constant(SemVer2, typeof(int?)))),
+                parameter);
+        });
+
         /// <summary>
         /// This could either indicate being SemVer1-compliant, or non-SemVer-compliant at all (e.g. System.Versioning pattern).
         /// </summary>
@@ -28,7 +59,7 @@ public static class SemVerLevelKey
         /// Indicates being SemVer2-compliant, but not SemVer1-compliant.
         /// This key corresponds to semVerLevel=2.0.0
         /// </summary>
-        public static readonly int SemVer2 = 2;
+        public const int SemVer2 = 2;
 
         /// <summary>
         /// Identifies the SemVer-level of a package based on original version string and dependency versions.
@@ -106,17 +137,27 @@ public static class SemVerLevelKey
         /// </summary>
         /// <param name="semVerLevel">The SemVer-level string indicating the SemVer-level to comply with.</param>
         /// <returns><c>True</c> if compliant; otherwise <c>false</c>.</returns>
-        public static Expression<Func<Package, bool>> IsPackageCompliantWithSemVerLevel(string semVerLevel)
+        public static Expression<Func<Package, bool>> IsPackageCompliantWithSemVerLevelPredicate(string semVerLevel)
         {
             // Note: we must return an expression that Linq to Entities is able to translate to SQL
             var parsedSemVerLevelKey = ForSemVerLevel(semVerLevel);
 
             if (parsedSemVerLevelKey == SemVer2)
             {
-                return p => p.SemVerLevelKey == Unknown || p.SemVerLevelKey == parsedSemVerLevelKey;
+                return IsSemVer2Predicate();
             }
 
-            return p => p.SemVerLevelKey == Unknown;
+            return IsUnknownPredicate();
+        }
+
+        public static Expression<Func<Package, bool>> IsSemVer2Predicate()
+        {
+            return _isSemVer2.Value;
+        }
+
+        public static Expression<Func<Package, bool>> IsUnknownPredicate()
+        {
+            return _isUnknown.Value;
         }
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs b/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs
index 50c7fa07c3..aab78a5a94 100644
--- a/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs
+++ b/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs
@@ -84,7 +84,7 @@ private DeleteSearchResult CreateDeleteSearchResult(Package package)
                     : NuGetVersion.Parse(package.Version).ToNormalizedString(),
                 DownloadCount = package.DownloadCount,
                 Listed = package.Listed,
-                Deleted = package.Deleted
+                Deleted = package.PackageStatusKey == PackageStatus.Deleted,
             };
         }
     }
diff --git a/src/NuGetGallery/Controllers/ODataV1FeedController.cs b/src/NuGetGallery/Controllers/ODataV1FeedController.cs
index 8fba345d97..5185d3d443 100644
--- a/src/NuGetGallery/Controllers/ODataV1FeedController.cs
+++ b/src/NuGetGallery/Controllers/ODataV1FeedController.cs
@@ -49,9 +49,10 @@ public IHttpActionResult Get(ODataQueryOptions<V1FeedPackage> options)
                 return BadRequest(ODataQueryVerifier.GetValidationFailedMessage(options));
             } 
             var queryable = _packagesRepository.GetAll()
-                                .Where(p => !p.IsPrerelease && !p.Deleted && p.SemVerLevelKey == SemVerLevelKey.Unknown)
+                                .Where(p => !p.IsPrerelease && p.PackageStatusKey == PackageStatus.Available)
+                                .Where(SemVerLevelKey.IsUnknownPredicate())
                                 .WithoutSortOnColumn(Version)
-                                .WithoutSortOnColumn(Id, ShouldIgnoreOrderById<V1FeedPackage>(options))
+                                .WithoutSortOnColumn(Id, ShouldIgnoreOrderById(options))
                                 .ToV1FeedPackageQuery(_configurationService.GetSiteRoot(UseHttps()));
 
             return QueryResult(options, queryable, MaxPageSize);
@@ -87,10 +88,10 @@ private async Task<IHttpActionResult> GetCore(ODataQueryOptions<V1FeedPackage> o
         {
             var packages = _packagesRepository.GetAll()
                 .Include(p => p.PackageRegistration)
-                .Where(p => p.PackageRegistration.Id.Equals(id, StringComparison.OrdinalIgnoreCase) 
-                        && !p.IsPrerelease 
-                        && !p.Deleted 
-                        && p.SemVerLevelKey == SemVerLevelKey.Unknown);
+                .Where(p => p.PackageRegistration.Id.Equals(id, StringComparison.OrdinalIgnoreCase)
+                            && !p.IsPrerelease
+                            && p.PackageStatusKey == PackageStatus.Available)
+                .Where(SemVerLevelKey.IsUnknownPredicate());
 
             if (!string.IsNullOrEmpty(version))
             {
@@ -190,7 +191,8 @@ public async Task<IHttpActionResult> Search(
             var packages = _packagesRepository.GetAll()
                 .Include(p => p.PackageRegistration)
                 .Include(p => p.PackageRegistration.Owners)
-                .Where(p => p.Listed && !p.IsPrerelease && !p.Deleted && p.SemVerLevelKey == SemVerLevelKey.Unknown)
+                .Where(p => p.Listed && !p.IsPrerelease && p.PackageStatusKey == PackageStatus.Available)
+                .Where(SemVerLevelKey.IsUnknownPredicate())
                 .OrderBy(p => p.PackageRegistration.Id).ThenBy(p => p.Version)
                 .AsNoTracking();
 
diff --git a/src/NuGetGallery/Controllers/ODataV2CuratedFeedController.cs b/src/NuGetGallery/Controllers/ODataV2CuratedFeedController.cs
index a613140515..c73adef58a 100644
--- a/src/NuGetGallery/Controllers/ODataV2CuratedFeedController.cs
+++ b/src/NuGetGallery/Controllers/ODataV2CuratedFeedController.cs
@@ -57,7 +57,7 @@ public IHttpActionResult Get(
             var semVerLevelKey = SemVerLevelKey.ForSemVerLevel(semVerLevel);
 
             var queryable = _curatedFeedService.GetPackages(curatedFeedName)
-                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevel(semVerLevel))
+                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel))
                 .ToV2FeedPackageQuery(
                     _configurationService.GetSiteRoot(UseHttps()),
                     _configurationService.Features.FriendlyLicenses, 
@@ -125,7 +125,7 @@ private async Task<IHttpActionResult> GetCore(
             }
 
             var packages = _curatedFeedService.GetPackages(curatedFeedName)
-                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevel(semVerLevel))
+                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel))
                 .Where(p => p.PackageRegistration.Id.Equals(id, StringComparison.OrdinalIgnoreCase));
 
             if (!string.IsNullOrEmpty(normalizedVersion))
@@ -239,7 +239,7 @@ public async Task<IHttpActionResult> Search(
             // Perform actual search
             var curatedFeed = _curatedFeedService.GetFeedByName(curatedFeedName, includePackages: false);
             var packages = _curatedFeedService.GetPackages(curatedFeedName)
-                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevel(semVerLevel))
+                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel))
                 .OrderBy(p => p.PackageRegistration.Id).ThenBy(p => p.Version);
 
             // todo: search hijack should take queryOptions instead of manually parsing query options
diff --git a/src/NuGetGallery/Controllers/ODataV2FeedController.cs b/src/NuGetGallery/Controllers/ODataV2FeedController.cs
index 39cdc679cc..0c8d7b0e50 100644
--- a/src/NuGetGallery/Controllers/ODataV2FeedController.cs
+++ b/src/NuGetGallery/Controllers/ODataV2FeedController.cs
@@ -53,10 +53,10 @@ public async Task<IHttpActionResult> Get(
         {
             // Setup the search
             var packages = _packagesRepository.GetAll()
-                                .Where(p => !p.Deleted)
-                                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevel(semVerLevel))
+                                .Where(p => p.PackageStatusKey == PackageStatus.Available)
+                                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel))
                                 .WithoutSortOnColumn(Version)
-                                .WithoutSortOnColumn(Id, ShouldIgnoreOrderById<V2FeedPackage>(options))
+                                .WithoutSortOnColumn(Id, ShouldIgnoreOrderById(options))
                                 .InterceptWith(new NormalizeVersionInterceptor());
 
             var semVerLevelKey = SemVerLevelKey.ForSemVerLevel(semVerLevel);
@@ -188,9 +188,9 @@ private async Task<IHttpActionResult> GetCore(
         {
             var packages = _packagesRepository.GetAll()
                 .Include(p => p.PackageRegistration)
-                .Where(p => p.PackageRegistration.Id.Equals(id, StringComparison.OrdinalIgnoreCase)
-                            && !p.Deleted)
-                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevel(semVerLevel));
+                .Where(p => p.PackageStatusKey == PackageStatus.Available
+                            && p.PackageRegistration.Id.Equals(id, StringComparison.OrdinalIgnoreCase))
+                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel));
 
             if (!string.IsNullOrEmpty(version))
             {
@@ -308,8 +308,8 @@ public async Task<IHttpActionResult> Search(
             var packages = _packagesRepository.GetAll()
                 .Include(p => p.PackageRegistration)
                 .Include(p => p.PackageRegistration.Owners)
-                .Where(p => p.Listed && !p.Deleted)
-                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevel(semVerLevel))
+                .Where(p => p.Listed && p.PackageStatusKey == PackageStatus.Available)
+                .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel))
                 .OrderBy(p => p.PackageRegistration.Id).ThenBy(p => p.Version)
                 .AsNoTracking();
 
@@ -458,9 +458,9 @@ public IHttpActionResult GetUpdates(
             var packages = _packagesRepository.GetAll()
                 .Include(p => p.PackageRegistration)
                 .Include(p => p.SupportedFrameworks)
-                .Where(p =>
-                    p.Listed && (includePrerelease || !p.IsPrerelease) && !p.Deleted &&
-                    idValues.Contains(p.PackageRegistration.Id.ToLower()))
+                .Where(p => p.Listed && (includePrerelease || !p.IsPrerelease)
+                            && idValues.Contains(p.PackageRegistration.Id.ToLower())
+                            && p.PackageStatusKey == PackageStatus.Available)
                 .OrderBy(p => p.PackageRegistration.Id);
 
             var semVerLevelKey = SemVerLevelKey.ForSemVerLevel(semVerLevel);
@@ -506,7 +506,7 @@ private static IEnumerable<Package> GetUpdates(
             bool includeAllVersions,
             string semVerLevel)
         {
-            var isSemVerLevelCompliant = SemVerLevelKey.IsPackageCompliantWithSemVerLevel(semVerLevel).Compile();
+            var isSemVerLevelCompliant = SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel).Compile();
 
             var updates = from p in packages.AsEnumerable()
                           let version = NuGetVersion.Parse(p.Version)
diff --git a/src/NuGetGallery/Infrastructure/Lucene/LuceneIndexingService.cs b/src/NuGetGallery/Infrastructure/Lucene/LuceneIndexingService.cs
index 4c2346904c..ea523d7776 100644
--- a/src/NuGetGallery/Infrastructure/Lucene/LuceneIndexingService.cs
+++ b/src/NuGetGallery/Infrastructure/Lucene/LuceneIndexingService.cs
@@ -108,7 +108,9 @@ public void UpdatePackage(Package package)
                 {
                     // Someone passed us in a version which was e.g. just unlisted? Or just not the latest version which is what we want to index. Doesn't really matter. We'll find one to index.
                     package = _packageRepository.GetAll()
-                        .Where(p => !p.Deleted && (p.IsLatest || p.IsLatestStable) && p.PackageRegistrationKey == packageRegistrationKey)
+                        .Where(p => (p.IsLatest || p.IsLatestStable)
+                                    && p.PackageRegistrationKey == packageRegistrationKey
+                                    && p.PackageStatusKey == PackageStatus.Available)
                         .Include(p => p.PackageRegistration)
                         .Include(p => p.PackageRegistration.Owners)
                         .Include(p => p.SupportedFrameworks)
@@ -137,7 +139,9 @@ public void UpdatePackage(Package package)
 
         private List<PackageIndexEntity> GetPackages(DateTime? lastIndexTime)
         {
-            IQueryable<Package> set = _packageRepository.GetAll().Where(p => !p.Deleted);
+            IQueryable<Package> set = _packageRepository
+                .GetAll()
+                .Where(p => p.PackageStatusKey == PackageStatus.Available);
 
             if (lastIndexTime.HasValue)
             {
diff --git a/src/NuGetGallery/OData/SearchService/SearchAdaptor.cs b/src/NuGetGallery/OData/SearchService/SearchAdaptor.cs
index 7e83862412..a8be81f2d0 100644
--- a/src/NuGetGallery/OData/SearchService/SearchAdaptor.cs
+++ b/src/NuGetGallery/OData/SearchService/SearchAdaptor.cs
@@ -161,7 +161,7 @@ public static async Task<SearchAdaptorResult> SearchCore(
                 packages = packages.Where(p => !p.IsPrerelease);
             }
 
-            packages = packages.Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevel(semVerLevel));
+            packages = packages.Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel));
     
             return new SearchAdaptorResult(false, packages.Search(searchTerm));
         }
diff --git a/src/NuGetGallery/Queries/AutoCompleteDatabasePackageVersionsQuery.cs b/src/NuGetGallery/Queries/AutoCompleteDatabasePackageVersionsQuery.cs
index 771feb607b..39f2286aa7 100644
--- a/src/NuGetGallery/Queries/AutoCompleteDatabasePackageVersionsQuery.cs
+++ b/src/NuGetGallery/Queries/AutoCompleteDatabasePackageVersionsQuery.cs
@@ -11,10 +11,10 @@ namespace NuGetGallery
     public class AutoCompleteDatabasePackageVersionsQuery
         : AutoCompleteDatabaseQuery, IAutoCompletePackageVersionsQuery
     {
-        private const string _sqlFormat = @"SELECT p.[Version]
+        private static readonly string _sqlFormat = @"SELECT p.[Version]
 FROM Packages p (NOLOCK)
 	JOIN PackageRegistrations pr (NOLOCK) on pr.[Key] = p.PackageRegistrationKey
-WHERE p.[Deleted] <> 1 AND p.[Listed] = 1 AND {0} AND pr.ID = {{0}}
+WHERE p.[PackageStatusKey] = " + (int)PackageStatus.Available + @" AND p.[Listed] = 1 AND {0} AND pr.ID = {{0}}
 	{1}";
 
         public AutoCompleteDatabasePackageVersionsQuery(IEntitiesContext entities)
diff --git a/src/NuGetGallery/Services/PackageDeleteService.cs b/src/NuGetGallery/Services/PackageDeleteService.cs
index caf3d6a7fe..0910b73435 100644
--- a/src/NuGetGallery/Services/PackageDeleteService.cs
+++ b/src/NuGetGallery/Services/PackageDeleteService.cs
@@ -85,7 +85,9 @@ public async Task SoftDeletePackagesAsync(IEnumerable<Package> packages, User de
                 foreach (var package in packages)
                 {
                     package.Listed = false;
+#pragma warning disable CS0612 // Type or member is obsolete
                     package.Deleted = true;
+#pragma warning restore CS0612 // Type or member is obsolete
                     package.PackageStatusKey = PackageStatus.Deleted;
                     packageDelete.Packages.Add(package);
 
diff --git a/src/NuGetGallery/Services/PackageNamingConflictValidator.cs b/src/NuGetGallery/Services/PackageNamingConflictValidator.cs
index 8d6e0c85de..17ee79640d 100644
--- a/src/NuGetGallery/Services/PackageNamingConflictValidator.cs
+++ b/src/NuGetGallery/Services/PackageNamingConflictValidator.cs
@@ -55,8 +55,9 @@ public bool IdConflictsWithExistingPackageTitle(string registrationId)
 
             registrationId = registrationId.ToLowerInvariant();
 
+            // We allow any package status aside from soft-deleted to be considered for ID/title conflicts.
             return _packageRepository.GetAll()
-                .Any(p => !p.Deleted && p.Title.ToLower() == registrationId);
+                .Any(p => p.PackageStatusKey != PackageStatus.Deleted && p.Title.ToLower() == registrationId);
         }
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/PackageService.cs b/src/NuGetGallery/Services/PackageService.cs
index 34545ab1e6..40200dd9e3 100644
--- a/src/NuGetGallery/Services/PackageService.cs
+++ b/src/NuGetGallery/Services/PackageService.cs
@@ -470,7 +470,7 @@ public async Task MarkPackageListedAsync(Package package, bool commitChanges = t
                 return;
             }
 
-            if (package.Deleted)
+            if (package.PackageStatusKey == PackageStatus.Deleted)
             {
                 throw new InvalidOperationException("A deleted package should never be listed!");
             }
@@ -836,12 +836,16 @@ public virtual async Task UpdateIsLatestAsync(PackageRegistration packageRegistr
 
             // If the last listed package was just unlisted, then we won't find another one
             var latestPackage = FindPackage(
-                packageRegistration.Packages,
-                p => !p.Deleted && p.Listed && p.SemVerLevelKey == SemVerLevelKey.Unknown);
+                packageRegistration.Packages.AsQueryable(),
+                ps => ps
+                    .Where(SemVerLevelKey.IsUnknownPredicate())
+                    .Where(p => p.PackageStatusKey == PackageStatus.Available && p.Listed));
 
             var latestSemVer2Package = FindPackage(
-                packageRegistration.Packages,
-                p => !p.Deleted && p.Listed && (p.SemVerLevelKey == SemVerLevelKey.SemVer2 || p.SemVerLevelKey == SemVerLevelKey.Unknown));
+                packageRegistration.Packages.AsQueryable(),
+                ps => ps
+                    .Where(SemVerLevelKey.IsSemVer2Predicate())
+                    .Where(p => p.PackageStatusKey == PackageStatus.Available && p.Listed));
 
             if (latestPackage != null)
             {
@@ -852,8 +856,11 @@ public virtual async Task UpdateIsLatestAsync(PackageRegistration packageRegistr
                 {
                     // If the newest uploaded package is a prerelease package, we need to find an older package that is
                     // a release version and set it to IsLatest.
-                    var latestReleasePackage = FindPackage(
-                        packageRegistration.Packages.Where(p => !p.IsPrerelease && !p.Deleted && p.Listed && p.SemVerLevelKey == SemVerLevelKey.Unknown));
+                    var latestReleasePackage = FindPackage(packageRegistration
+                        .Packages
+                        .AsQueryable()
+                        .Where(SemVerLevelKey.IsUnknownPredicate())
+                        .Where(p => !p.IsPrerelease && p.PackageStatusKey == PackageStatus.Available && p.Listed));
 
                     if (latestReleasePackage != null)
                     {
@@ -878,8 +885,11 @@ public virtual async Task UpdateIsLatestAsync(PackageRegistration packageRegistr
                 {
                     // If the newest uploaded package is a prerelease package, we need to find an older package that is
                     // a release version and set it to IsLatest.
-                    var latestSemVer2ReleasePackage = FindPackage(
-                        packageRegistration.Packages.Where(p => !p.IsPrerelease && !p.Deleted && p.Listed && (p.SemVerLevelKey == SemVerLevelKey.SemVer2 || p.SemVerLevelKey == SemVerLevelKey.Unknown)));
+                    var latestSemVer2ReleasePackage = FindPackage(packageRegistration
+                        .Packages
+                        .AsQueryable()
+                        .Where(SemVerLevelKey.IsSemVer2Predicate())
+                        .Where(p => !p.IsPrerelease && p.PackageStatusKey == PackageStatus.Available && p.Listed));
 
                     if (latestSemVer2ReleasePackage != null)
                     {
@@ -901,11 +911,11 @@ public virtual async Task UpdateIsLatestAsync(PackageRegistration packageRegistr
             }
         }
 
-        private static Package FindPackage(IEnumerable<Package> packages, Func<Package, bool> predicate = null)
+        private static Package FindPackage(IQueryable<Package> packages, Func<IQueryable<Package>, IQueryable<Package>> predicate = null)
         {
             if (predicate != null)
             {
-                packages = packages.Where(predicate);
+                packages = predicate(packages);
             }
 
             NuGetVersion version = packages.Max(p => new NuGetVersion(p.Version));
diff --git a/src/NuGetGallery/ViewModels/PackageViewModel.cs b/src/NuGetGallery/ViewModels/PackageViewModel.cs
index 6dd3de8597..1baabdf739 100644
--- a/src/NuGetGallery/ViewModels/PackageViewModel.cs
+++ b/src/NuGetGallery/ViewModels/PackageViewModel.cs
@@ -48,7 +48,7 @@ public PackageViewModel(Package package)
             LatestStableVersionSemVer2 = package.IsLatestStableSemVer2;
             LastUpdated = package.Published;
             Listed = package.Listed;
-            Deleted = package.Deleted;
+            Deleted = package.PackageStatusKey == PackageStatus.Deleted;
             DownloadCount = package.DownloadCount;
             Prerelease = package.IsPrerelease;
             LicenseReportUrl = package.LicenseReportUrl;
diff --git a/tests/NuGetGallery.Core.Facts/Auditing/AuditingServiceTests.cs b/tests/NuGetGallery.Core.Facts/Auditing/AuditingServiceTests.cs
index 5e2bbe2e57..5afc05029a 100644
--- a/tests/NuGetGallery.Core.Facts/Auditing/AuditingServiceTests.cs
+++ b/tests/NuGetGallery.Core.Facts/Auditing/AuditingServiceTests.cs
@@ -91,12 +91,14 @@ public async Task SaveAuditRecordAsync_PackageAuditRecord()
             {
                 Copyright = "a",
                 Created = DateTime.Now,
+#pragma warning disable CS0612 // Type or member is obsolete
                 Deleted = true,
+#pragma warning restore CS0612 // Type or member is obsolete
                 Description = "b",
                 DownloadCount = 1,
-#pragma warning disable 612
+#pragma warning disable CS0612 // Type or member is obsolete
                 ExternalPackageUrl = "c",
-#pragma warning restore 612
+#pragma warning restore CS0612 // Type or member is obsolete
                 FlattenedAuthors = "d",
                 FlattenedDependencies = "e",
                 Hash = "f",
@@ -119,6 +121,7 @@ public async Task SaveAuditRecordAsync_PackageAuditRecord()
                 PackageFileSize = 3,
                 PackageRegistration = new PackageRegistration() { Id = "o" },
                 PackageRegistrationKey = 4,
+                PackageStatusKey = PackageStatus.Deleted,
                 ProjectUrl = "p",
                 Published = DateTime.Now.AddMinutes(3),
                 ReleaseNotes = "q",
@@ -183,6 +186,7 @@ public async Task SaveAuditRecordAsync_PackageAuditRecord()
                 Assert.Equal("m", packageRecord["MinClientVersion"].Value<string>());
                 Assert.Equal(5, packageRecord["UserKey"].Value<int>());
                 Assert.True(packageRecord["Deleted"].Value<bool>());
+                Assert.Equal(1, packageRecord["PackageStatusKey"].Value<int>());
 
                 var registrationRecord = record["RegistrationRecord"];
 
diff --git a/tests/NuGetGallery.Core.Facts/SemVerLevelKeyFacts.cs b/tests/NuGetGallery.Core.Facts/SemVerLevelKeyFacts.cs
index 769673f81c..0e866907f6 100644
--- a/tests/NuGetGallery.Core.Facts/SemVerLevelKeyFacts.cs
+++ b/tests/NuGetGallery.Core.Facts/SemVerLevelKeyFacts.cs
@@ -150,7 +150,7 @@ public void DefaultsToUnknownKeyWhenVersionStringIsNull()
             }
         }
 
-        public class TheIsCompliantWithSemVerLevelMethod
+        public class TheIsCompliantWithSemVerLevelPredicateMethod
         {
             [Theory]
             // Versions higher than SemVer v2.0.0
@@ -212,10 +212,28 @@ public void SemVer2Key_IsNotCompliantWithUnknownSemVerLevel()
             private static void AssertPackageIsComplianceWithSemVerLevel(int? packageSemVerLevelKey, string semVerLevel, bool shouldBeCompliant)
             {
                 var package = new Package { SemVerLevelKey = packageSemVerLevelKey };
-                var compiledFunction = SemVerLevelKey.IsPackageCompliantWithSemVerLevel(semVerLevel).Compile();
+                var compiledFunction = SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel).Compile();
 
                 Assert.Equal(shouldBeCompliant, compiledFunction(package));
             }
         }
+
+        public class TheIsUnknownPredicateMethod
+        {
+            [Theory]
+            [InlineData(null, true)]
+            [InlineData(1, false)]
+            [InlineData(2, false)]
+            [InlineData(3, false)]
+            public void IsUnknown(int? semVerLevelKey, bool expected)
+            {
+                var package = new Package { SemVerLevelKey = semVerLevelKey };
+                var compiledFunction = SemVerLevelKey.IsUnknownPredicate().Compile();
+
+                var actual = compiledFunction(package);
+
+                Assert.Equal(expected, actual);
+            }
+        }
     }
 }
\ No newline at end of file
diff --git a/tests/NuGetGallery.Facts/Services/FeedServiceFacts.cs b/tests/NuGetGallery.Facts/Services/FeedServiceFacts.cs
index 536149c8a7..713abb527c 100644
--- a/tests/NuGetGallery.Facts/Services/FeedServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/FeedServiceFacts.cs
@@ -264,7 +264,7 @@ public async Task V1FeedSearchDoesNotReturnDeletedPackages()
                                 Version = "1.0.0",
                                 IsPrerelease = false,
                                 Listed = true,
-                                Deleted = true
+                                PackageStatusKey = PackageStatus.Deleted,
                             },
                         new Package
                             {
@@ -272,7 +272,7 @@ public async Task V1FeedSearchDoesNotReturnDeletedPackages()
                                 Version = "1.1.0",
                                 IsPrerelease = false,
                                 Listed = true,
-                                Deleted = false
+                                PackageStatusKey = PackageStatus.Available,
                             },
                     }.AsQueryable());
                     var configuration = new Mock<IGalleryConfigurationService>(MockBehavior.Strict);
@@ -363,7 +363,7 @@ public async Task V1FeedFindPackagesByIdDoesNotReturnDeletedPackages()
                                 Version = "1.0.0",
                                 IsPrerelease = false,
                                 Listed = false,
-                                Deleted = true
+                                PackageStatusKey = PackageStatus.Deleted,
                             },
                         new Package
                             {
@@ -371,7 +371,7 @@ public async Task V1FeedFindPackagesByIdDoesNotReturnDeletedPackages()
                                 Version = "1.0.1",
                                 IsPrerelease = false,
                                 Listed = true,
-                                Deleted = true
+                                PackageStatusKey = PackageStatus.Deleted,
                             },
                     }.AsQueryable());
                     var configuration = new Mock<IGalleryConfigurationService>(MockBehavior.Strict);
@@ -847,7 +847,7 @@ public async Task V2FeedFindPackagesByIdDoesNotReturnDeletedPackages()
                                 Version = "1.0.0",
                                 IsPrerelease = false,
                                 Listed = false,
-                                Deleted = true
+                                PackageStatusKey = PackageStatus.Deleted,
                             },
                         new Package
                             {
@@ -855,7 +855,7 @@ public async Task V2FeedFindPackagesByIdDoesNotReturnDeletedPackages()
                                 Version = "1.0.1",
                                 IsPrerelease = false,
                                 Listed = true,
-                                Deleted = true
+                                PackageStatusKey = PackageStatus.Deleted,
                             },
                     }.AsQueryable());
                     var configuration = new Mock<IGalleryConfigurationService>(MockBehavior.Strict);
@@ -1449,7 +1449,7 @@ public void V2FeedGetUpdatesDoesNotReturnDeletedPackages()
                         new[]
                     {
                         new Package { PackageRegistration = packageRegistrationA, Version = "1.0.0", IsPrerelease = false, Listed = true },
-                        new Package { PackageRegistration = packageRegistrationA, Version = "1.1.0", IsPrerelease = false, Deleted = true }
+                        new Package { PackageRegistration = packageRegistrationA, Version = "1.1.0", IsPrerelease = false, PackageStatusKey = PackageStatus.Deleted }
                     }.AsQueryable());
                     var configuration = new Mock<IGalleryConfigurationService>(MockBehavior.Strict);
                     configuration.Setup(c => c.GetSiteRoot(It.IsAny<bool>())).Returns("https://localhost:8081/");
diff --git a/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
index 7488ef5a2a..f3d5b248f8 100644
--- a/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
@@ -121,7 +121,9 @@ public async Task WillUpdateThePackage()
                 await service.SoftDeletePackagesAsync(new[] { package }, user, reason, signature);
 
                 Assert.False(package.Listed);
+#pragma warning disable CS0612 // Type or member is obsolete
                 Assert.True(package.Deleted);
+#pragma warning restore CS0612 // Type or member is obsolete
                 Assert.Equal(PackageStatus.Deleted, package.PackageStatusKey);
             }
 
@@ -156,7 +158,9 @@ public async Task WillUpdateThePackageRepository()
 
                 await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
 
+#pragma warning disable CS0612 // Type or member is obsolete
                 Assert.True(package.Deleted);
+#pragma warning restore CS0612 // Type or member is obsolete
                 Assert.Equal(PackageStatus.Deleted, package.PackageStatusKey);
                 packageRepository.Verify(x => x.CommitChangesAsync());
                 packageDeleteRepository.Verify(x => x.InsertOnCommit(It.IsAny<PackageDelete>()));
diff --git a/tests/NuGetGallery.Facts/Services/PackageNamingConflictValidatorFacts.cs b/tests/NuGetGallery.Facts/Services/PackageNamingConflictValidatorFacts.cs
index 41483b9a97..d849df9cf0 100644
--- a/tests/NuGetGallery.Facts/Services/PackageNamingConflictValidatorFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageNamingConflictValidatorFacts.cs
@@ -80,7 +80,7 @@ public void IdConflictsWithExistingPackageTitle_DoesNotSupportTitleReuseWithNonD
                 Version = "1.0.0",
                 Title = "B",
                 Listed = isExistingPackageListed,
-                Deleted = false
+                PackageStatusKey = PackageStatus.Available,
             };
             var target = CreateValidator(packageRegistration, package);
 
@@ -106,7 +106,7 @@ public void IdConflictsWithExistingPackageTitle_SupportsTitleReuseWithSoftDelete
                 Version = "1.0.0",
                 Title = "B",
                 Listed = false,
-                Deleted = true
+                PackageStatusKey = PackageStatus.Deleted,
             };
             var target = CreateValidator(packageRegistration, package);
 
diff --git a/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
index 6a90e9dead..b322b9a7c6 100644
--- a/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
@@ -1605,7 +1605,13 @@ public async Task OnPackageVersionHigherThanLatestSetsItToLatestVersion()
             public async Task ThrowsWhenPackageDeleted()
             {
                 var packageRegistration = new PackageRegistration { Id = "theId" };
-                var package = new Package { Version = "1.0", PackageRegistration = packageRegistration, Listed = false, Deleted = true };
+                var package = new Package
+                {
+                    Version = "1.0",
+                    PackageRegistration = packageRegistration,
+                    Listed = false,
+                    PackageStatusKey = PackageStatus.Deleted,
+                };
                 var packageRepository = new Mock<IEntityRepository<Package>>();
                 var service = CreateService(packageRepository: packageRepository);
 
diff --git a/tests/NuGetGallery.Facts/TestUtils/Infrastructure/FeedServiceHelpers.cs b/tests/NuGetGallery.Facts/TestUtils/Infrastructure/FeedServiceHelpers.cs
index 11835fd7a8..6ca3d5e4bc 100644
--- a/tests/NuGetGallery.Facts/TestUtils/Infrastructure/FeedServiceHelpers.cs
+++ b/tests/NuGetGallery.Facts/TestUtils/Infrastructure/FeedServiceHelpers.cs
@@ -126,7 +126,7 @@ public static Mock<IEntityRepository<Package>> SetupTestPackageRepository()
                     NormalizedVersion = "1.0.0",
                     IsPrerelease = false,
                     Listed = false,
-                    Deleted = true, // plot twist: this package is a soft-deleted one
+                    PackageStatusKey = PackageStatus.Deleted, // plot twist: this package is a soft-deleted one
                     Authors = new [] { new PackageAuthor { Name = "Test "} },
                     FlattenedAuthors = "Test",
                     Description = "Baz",

From 3d7f78743937e8ad615b90bd5d3d0fa0fd032b74 Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Fri, 22 Sep 2017 11:20:02 -0700
Subject: [PATCH 02/25] Move logic needed by other components out of
 PackageService into CorePackageService (#4721)

Add the UpdatePackageStatusAsync method for package status transitions
---
 .../NuGetGallery.Core.csproj                  |   2 +
 .../Services/CorePackageService.cs            | 215 +++++++++
 .../Services/ICorePackageService.cs           |  37 ++
 src/NuGetGallery/Services/IPackageService.cs  |  16 +-
 .../Services/PackageDeleteService.cs          |  17 +-
 src/NuGetGallery/Services/PackageService.cs   | 147 +-----
 .../NuGetGallery.Core.Facts.csproj            |   1 +
 .../Services/CorePackageServiceFacts.cs       | 454 ++++++++++++++++++
 .../Services/PackageDeleteServiceFacts.cs     |  16 +-
 .../Services/PackageServiceFacts.cs           | 249 +---------
 10 files changed, 731 insertions(+), 423 deletions(-)
 create mode 100644 src/NuGetGallery.Core/Services/CorePackageService.cs
 create mode 100644 src/NuGetGallery.Core/Services/ICorePackageService.cs
 create mode 100644 tests/NuGetGallery.Core.Facts/Services/CorePackageServiceFacts.cs

diff --git a/src/NuGetGallery.Core/NuGetGallery.Core.csproj b/src/NuGetGallery.Core/NuGetGallery.Core.csproj
index 9c0ef1df05..0b9692e620 100644
--- a/src/NuGetGallery.Core/NuGetGallery.Core.csproj
+++ b/src/NuGetGallery.Core/NuGetGallery.Core.csproj
@@ -205,6 +205,8 @@
     <Compile Include="Properties\AssemblyInfo.*.cs" />
     <Compile Include="NuGetVersionExtensions.cs" />
     <Compile Include="SemVerLevelKey.cs" />
+    <Compile Include="Services\CorePackageService.cs" />
+    <Compile Include="Services\ICorePackageService.cs" />
     <Compile Include="StreamExtensions.cs" />
     <Compile Include="CoreStrings.Designer.cs">
       <AutoGen>True</AutoGen>
diff --git a/src/NuGetGallery.Core/Services/CorePackageService.cs b/src/NuGetGallery.Core/Services/CorePackageService.cs
new file mode 100644
index 0000000000..1aa9dbca0a
--- /dev/null
+++ b/src/NuGetGallery.Core/Services/CorePackageService.cs
@@ -0,0 +1,215 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Data.Entity;
+using System.Linq;
+using System.Threading.Tasks;
+using NuGet.Versioning;
+
+namespace NuGetGallery
+{
+    public class CorePackageService : ICorePackageService
+    {
+        protected readonly IEntityRepository<Package> _packageRepository;
+        
+        public CorePackageService(IEntityRepository<Package> packageRepository)
+        {
+            _packageRepository = packageRepository;
+        }
+
+        public virtual async Task UpdatePackageStatusAsync(
+            Package package,
+            PackageStatus newPackageStatus,
+            bool commitChanges = true)
+        {
+            if (package == null)
+            {
+                throw new ArgumentNullException(nameof(package));
+            }
+
+            if (package.PackageRegistration == null)
+            {
+                throw new ArgumentException($"The {nameof(Package.PackageRegistration)} property must populated on the provided package.", nameof(package));
+            }
+
+            // Avoid all of this work if the package status is not changing.
+            if (package.PackageStatusKey != newPackageStatus)
+            {
+#pragma warning disable CS0612 // Type or member is obsolete
+                package.Deleted = newPackageStatus == PackageStatus.Deleted;
+#pragma warning restore CS0612 // Type or member is obsolete
+                package.PackageStatusKey = newPackageStatus;
+                package.LastUpdated = DateTime.UtcNow;
+
+                /// If the package is being made available, consider this change as an "edit" so that the package
+                /// appears for cursors on the <see cref="Package.LastEdited"/> field.
+                if (newPackageStatus == PackageStatus.Available)
+                {
+                    package.LastEdited = DateTime.UtcNow;
+                }
+
+                // If the package is just now becoming available or if it was previously a latest package, then
+                // re-evaluate all of the latest bits.
+                if (newPackageStatus == PackageStatus.Available ||
+                    package.IsLatest ||
+                    package.IsLatestStable ||
+                    package.IsLatestSemVer2 ||
+                    package.IsLatestStableSemVer2)
+                {
+                    await UpdateIsLatestAsync(package.PackageRegistration, commitChanges: false);
+                }
+            }
+
+            if (commitChanges)
+            {
+                // Even if the package status did not change, commit the changes in the entity context to pick up any
+                // other entity changes.
+                await _packageRepository.CommitChangesAsync();
+            }
+        }
+
+        public virtual async Task UpdateIsLatestAsync(PackageRegistration packageRegistration, bool commitChanges = true)
+        {
+            if (!packageRegistration.Packages.Any())
+            {
+                return;
+            }
+
+            // TODO: improve setting the latest bit; this is horrible. Trigger maybe?
+            var currentUtcTime = DateTime.UtcNow;
+            foreach (var pv in packageRegistration.Packages.Where(p => p.IsLatest || p.IsLatestStable || p.IsLatestSemVer2 || p.IsLatestStableSemVer2))
+            {
+                pv.IsLatest = false;
+                pv.IsLatestStable = false;
+                pv.IsLatestSemVer2 = false;
+                pv.IsLatestStableSemVer2 = false;
+                pv.LastUpdated = currentUtcTime;
+            }
+
+            // If the last listed package was just unlisted, then we won't find another one
+            var latestPackage = FindPackage(
+                packageRegistration.Packages.AsQueryable(),
+                ps => ps
+                    .Where(SemVerLevelKey.IsUnknownPredicate())
+                    .Where(p => p.PackageStatusKey == PackageStatus.Available && p.Listed));
+
+            var latestSemVer2Package = FindPackage(
+                packageRegistration.Packages.AsQueryable(),
+                ps => ps
+                    .Where(SemVerLevelKey.IsSemVer2Predicate())
+                    .Where(p => p.PackageStatusKey == PackageStatus.Available && p.Listed));
+
+            if (latestPackage != null)
+            {
+                latestPackage.IsLatest = true;
+                latestPackage.LastUpdated = currentUtcTime;
+
+                if (latestPackage.IsPrerelease)
+                {
+                    // If the newest uploaded package is a prerelease package, we need to find an older package that is
+                    // a release version and set it to IsLatest.
+                    var latestReleasePackage = FindPackage(packageRegistration
+                        .Packages
+                        .AsQueryable()
+                        .Where(SemVerLevelKey.IsUnknownPredicate())
+                        .Where(p => !p.IsPrerelease && p.PackageStatusKey == PackageStatus.Available && p.Listed));
+
+                    if (latestReleasePackage != null)
+                    {
+                        // We could have no release packages
+                        latestReleasePackage.IsLatestStable = true;
+                        latestReleasePackage.LastUpdated = currentUtcTime;
+                    }
+                }
+                else
+                {
+                    // Only release versions are marked as IsLatestStable.
+                    latestPackage.IsLatestStable = true;
+                }
+            }
+
+            if (latestSemVer2Package != null)
+            {
+                latestSemVer2Package.IsLatestSemVer2 = true;
+                latestSemVer2Package.LastUpdated = currentUtcTime;
+
+                if (latestSemVer2Package.IsPrerelease)
+                {
+                    // If the newest uploaded package is a prerelease package, we need to find an older package that is
+                    // a release version and set it to IsLatest.
+                    var latestSemVer2ReleasePackage = FindPackage(packageRegistration
+                        .Packages
+                        .AsQueryable()
+                        .Where(SemVerLevelKey.IsSemVer2Predicate())
+                        .Where(p => !p.IsPrerelease && p.PackageStatusKey == PackageStatus.Available && p.Listed));
+
+                    if (latestSemVer2ReleasePackage != null)
+                    {
+                        // We could have no release packages
+                        latestSemVer2ReleasePackage.IsLatestStableSemVer2 = true;
+                        latestSemVer2ReleasePackage.LastUpdated = currentUtcTime;
+                    }
+                }
+                else
+                {
+                    // Only release versions are marked as IsLatestStable.
+                    latestSemVer2Package.IsLatestStableSemVer2 = true;
+                }
+            }
+
+            if (commitChanges)
+            {
+                await _packageRepository.CommitChangesAsync();
+            }
+        }
+
+        public virtual Package FindPackageByIdAndVersionStrict(string id, string version)
+        {
+            if (string.IsNullOrWhiteSpace(id))
+            {
+                throw new ArgumentNullException(nameof(id));
+            }
+
+            if (string.IsNullOrEmpty(version))
+            {
+                throw new ArgumentException(nameof(version));
+            }
+
+            var normalizedVersion = NuGetVersionFormatter.Normalize(version);
+
+            // These string comparisons are case-(in)sensitive depending on SQLServer collation.
+            // Case-insensitive collation is recommended, e.g. SQL_Latin1_General_CP1_CI_AS.
+            var package = GetPackagesByIdQueryable(id)
+                .SingleOrDefault(p => p.NormalizedVersion == normalizedVersion);
+
+            return package;
+        }
+
+        protected IQueryable<Package> GetPackagesByIdQueryable(string id)
+        {
+            return _packageRepository
+                .GetAll()
+                .Include(p => p.LicenseReports)
+                .Include(p => p.PackageRegistration)
+                .Where(p => p.PackageRegistration.Id == id);
+        }
+
+        private static Package FindPackage(IQueryable<Package> packages, Func<IQueryable<Package>, IQueryable<Package>> predicate = null)
+        {
+            if (predicate != null)
+            {
+                packages = predicate(packages);
+            }
+
+            NuGetVersion version = packages.Max(p => new NuGetVersion(p.Version));
+            if (version == null)
+            {
+                return null;
+            }
+
+            return packages.First(pv => pv.Version.Equals(version.OriginalVersion, StringComparison.OrdinalIgnoreCase));
+        }
+    }
+}
diff --git a/src/NuGetGallery.Core/Services/ICorePackageService.cs b/src/NuGetGallery.Core/Services/ICorePackageService.cs
new file mode 100644
index 0000000000..993d7584c3
--- /dev/null
+++ b/src/NuGetGallery.Core/Services/ICorePackageService.cs
@@ -0,0 +1,37 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Threading.Tasks;
+
+namespace NuGetGallery
+{
+    /// <summary>
+    /// Package business logic that is needed in multiple components (not just the Gallery process).
+    /// </summary>
+    public interface ICorePackageService
+    {
+        /// <summary>
+        /// Set the status on the package and any other related package properties.
+        /// </summary>
+        /// <param name="package">The package to update the status of.</param>
+        /// <param name="newPackageStatus">The new package status.</param>
+        /// <param name="commitChanges">Whether or not to commit the changes to the entity context.</param>
+        Task UpdatePackageStatusAsync(Package package, PackageStatus newPackageStatus, bool commitChanges = true);
+
+        /// <summary>
+        /// Gets the package with the given ID and version when exists; otherwise <c>null</c>.
+        /// </summary>
+        /// <param name="id">The package ID.</param>
+        /// <param name="version">The package version.</param>
+        Package FindPackageByIdAndVersionStrict(string id, string version);
+
+        /// <summary>
+        /// Updates the <see cref="Package.IsLatest"/> and related properties on all packages in the provided
+        /// <see cref="PackageRegistration"/>. The <see cref="PackageRegistration.Packages"/> collection must be
+        /// populated for this method to take effect.
+        /// </summary>
+        /// <param name="packageRegistration">The package registration.</param>
+        /// <param name="commitChanges">Whether or not to commit the changes to the packages.</param>
+        Task UpdateIsLatestAsync(PackageRegistration packageRegistration, bool commitChanges = true);
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/IPackageService.cs b/src/NuGetGallery/Services/IPackageService.cs
index d4906afdb2..729a29bbbf 100644
--- a/src/NuGetGallery/Services/IPackageService.cs
+++ b/src/NuGetGallery/Services/IPackageService.cs
@@ -8,7 +8,12 @@
 
 namespace NuGetGallery
 {
-    public interface IPackageService
+    /// <summary>
+    /// Business logic related to <see cref="Package"/> and <see cref="PackageRegistration"/> instances. This logic is
+    /// only used by the NuGet gallery, as opposed to the <see cref="CorePackageService"/> which is intended for other
+    /// components.
+    /// </summary>
+    public interface IPackageService : ICorePackageService
     {
         PackageRegistration FindPackageRegistrationById(string id);
 
@@ -23,20 +28,11 @@ public interface IPackageService
         /// <returns></returns>
         Package FindPackageByIdAndVersion(string id, string version, int? semVerLevelKey = null, bool allowPrerelease = true);
 
-        /// <summary>
-        /// Gets the package with the given ID and version when exists; otherwise <c>null</c>.
-        /// </summary>
-        /// <param name="id">The package ID.</param>
-        /// <param name="version">The package version.</param>
-        Package FindPackageByIdAndVersionStrict(string id, string version);
-
         Package FindAbsoluteLatestPackageById(string id, int? semVerLevelKey);
         IEnumerable<Package> FindPackagesByOwner(User user, bool includeUnlisted);
         IEnumerable<PackageRegistration> FindPackageRegistrationsByOwner(User user);
         IEnumerable<Package> FindDependentPackages(Package package);
 
-        Task UpdateIsLatestAsync(PackageRegistration packageRegistration, bool commitChanges = true);
-
         /// <summary>
         /// Populate the related database tables to create the specified package for the specified user.
         /// </summary>
diff --git a/src/NuGetGallery/Services/PackageDeleteService.cs b/src/NuGetGallery/Services/PackageDeleteService.cs
index 0910b73435..e3994b8fc1 100644
--- a/src/NuGetGallery/Services/PackageDeleteService.cs
+++ b/src/NuGetGallery/Services/PackageDeleteService.cs
@@ -84,11 +84,16 @@ public async Task SoftDeletePackagesAsync(IEnumerable<Package> packages, User de
 
                 foreach (var package in packages)
                 {
+                    /// We do not call <see cref="IPackageService.MarkPackageUnlistedAsync(Package, bool)"/> here
+                    /// because that writes an audit entry. Additionally, the latest bits are already updated by
+                    /// the package status change.
                     package.Listed = false;
-#pragma warning disable CS0612 // Type or member is obsolete
-                    package.Deleted = true;
-#pragma warning restore CS0612 // Type or member is obsolete
-                    package.PackageStatusKey = PackageStatus.Deleted;
+
+                    await _packageService.UpdatePackageStatusAsync(
+                        package,
+                        PackageStatus.Deleted,
+                        commitChanges: false);
+
                     packageDelete.Packages.Add(package);
 
                     await _auditingService.SaveAuditRecordAsync(CreateAuditRecord(package, package.PackageRegistration, AuditedPackageAction.SoftDelete, reason));
@@ -96,16 +101,12 @@ public async Task SoftDeletePackagesAsync(IEnumerable<Package> packages, User de
 
                 _packageDeletesRepository.InsertOnCommit(packageDelete);
 
-                // Update latest versions
-                await UpdateIsLatestAsync(packageRegistrations);
-
                 // Commit changes
                 await _packageRepository.CommitChangesAsync();
                 await _packageDeletesRepository.CommitChangesAsync();
                 transaction.Commit();
             }
 
-
             // Force refresh the index
             UpdateSearchIndex();
         }
diff --git a/src/NuGetGallery/Services/PackageService.cs b/src/NuGetGallery/Services/PackageService.cs
index 40200dd9e3..6fa7920f54 100644
--- a/src/NuGetGallery/Services/PackageService.cs
+++ b/src/NuGetGallery/Services/PackageService.cs
@@ -15,12 +15,11 @@
 
 namespace NuGetGallery
 {
-    public class PackageService : IPackageService
+    public class PackageService : CorePackageService, IPackageService
     {
         private readonly IIndexingService _indexingService;
         private readonly IEntityRepository<PackageOwnerRequest> _packageOwnerRequestRepository;
         private readonly IEntityRepository<PackageRegistration> _packageRegistrationRepository;
-        private readonly IEntityRepository<Package> _packageRepository;
         private readonly IPackageNamingConflictValidator _packageNamingConflictValidator;
         private readonly IAuditingService _auditingService;
 
@@ -30,7 +29,7 @@ public PackageService(
             IEntityRepository<PackageOwnerRequest> packageOwnerRequestRepository,
             IIndexingService indexingService,
             IPackageNamingConflictValidator packageNamingConflictValidator,
-            IAuditingService auditingService)
+            IAuditingService auditingService) : base(packageRepository)
         {
             if (packageRegistrationRepository == null)
             {
@@ -63,7 +62,6 @@ public PackageService(
             }
 
             _packageRegistrationRepository = packageRegistrationRepository;
-            _packageRepository = packageRepository;
             _packageOwnerRequestRepository = packageOwnerRequestRepository;
             _indexingService = indexingService;
             _packageNamingConflictValidator = packageNamingConflictValidator;
@@ -232,28 +230,6 @@ public virtual Package FindPackageByIdAndVersion(
             return package;
         }
 
-        public virtual Package FindPackageByIdAndVersionStrict(string id, string version)
-        {
-            if (string.IsNullOrWhiteSpace(id))
-            {
-                throw new ArgumentNullException(nameof(id));
-            }
-
-            if (string.IsNullOrEmpty(version))
-            {
-                throw new ArgumentException(nameof(version));
-            }
-
-            var normalizedVersion = NuGetVersionFormatter.Normalize(version);
-
-            // These string comparisons are case-(in)sensitive depending on SQLServer collation.
-            // Case-insensitive collation is recommended, e.g. SQL_Latin1_General_CP1_CI_AS.
-            var package = GetPackagesByIdQueryable(id)
-                .SingleOrDefault(p => p.NormalizedVersion == normalizedVersion);
-
-            return package;
-        }
-
         public virtual Package FindAbsoluteLatestPackageById(string id, int? semVerLevelKey)
         {
             var packageVersions = GetPackagesByIdQueryable(id);
@@ -566,14 +542,6 @@ public bool IsValidPackageOwnerRequest(PackageRegistration package, User pending
             return (request != null && request.ConfirmationCode == token);
         }
 
-        private IQueryable<Package> GetPackagesByIdQueryable(string id)
-        {
-            return _packageRepository.GetAll()
-                            .Include(p => p.LicenseReports)
-                            .Include(p => p.PackageRegistration)
-                            .Where(p => p.PackageRegistration.Id == id);
-        }
-
         private PackageRegistration CreateOrGetPackageRegistration(User currentUser, PackageMetadata packageMetadata, bool isVerified)
         {
             var packageRegistration = FindPackageRegistrationById(packageMetadata.Id);
@@ -816,117 +784,6 @@ private void ValidatePackageTitle(PackageMetadata packageMetadata)
             }
         }
 
-        public virtual async Task UpdateIsLatestAsync(PackageRegistration packageRegistration, bool commitChanges = true)
-        {
-            if (!packageRegistration.Packages.Any())
-            {
-                return;
-            }
-
-            // TODO: improve setting the latest bit; this is horrible. Trigger maybe?
-            var currentUtcTime = DateTime.UtcNow;
-            foreach (var pv in packageRegistration.Packages.Where(p => p.IsLatest || p.IsLatestStable || p.IsLatestSemVer2 || p.IsLatestStableSemVer2))
-            {
-                pv.IsLatest = false;
-                pv.IsLatestStable = false;
-                pv.IsLatestSemVer2 = false;
-                pv.IsLatestStableSemVer2 = false;
-                pv.LastUpdated = currentUtcTime;
-            }
-
-            // If the last listed package was just unlisted, then we won't find another one
-            var latestPackage = FindPackage(
-                packageRegistration.Packages.AsQueryable(),
-                ps => ps
-                    .Where(SemVerLevelKey.IsUnknownPredicate())
-                    .Where(p => p.PackageStatusKey == PackageStatus.Available && p.Listed));
-
-            var latestSemVer2Package = FindPackage(
-                packageRegistration.Packages.AsQueryable(),
-                ps => ps
-                    .Where(SemVerLevelKey.IsSemVer2Predicate())
-                    .Where(p => p.PackageStatusKey == PackageStatus.Available && p.Listed));
-
-            if (latestPackage != null)
-            {
-                latestPackage.IsLatest = true;
-                latestPackage.LastUpdated = currentUtcTime;
-
-                if (latestPackage.IsPrerelease)
-                {
-                    // If the newest uploaded package is a prerelease package, we need to find an older package that is
-                    // a release version and set it to IsLatest.
-                    var latestReleasePackage = FindPackage(packageRegistration
-                        .Packages
-                        .AsQueryable()
-                        .Where(SemVerLevelKey.IsUnknownPredicate())
-                        .Where(p => !p.IsPrerelease && p.PackageStatusKey == PackageStatus.Available && p.Listed));
-
-                    if (latestReleasePackage != null)
-                    {
-                        // We could have no release packages
-                        latestReleasePackage.IsLatestStable = true;
-                        latestReleasePackage.LastUpdated = currentUtcTime;
-                    }
-                }
-                else
-                {
-                    // Only release versions are marked as IsLatestStable.
-                    latestPackage.IsLatestStable = true;
-                }
-            }
-
-            if (latestSemVer2Package != null)
-            {
-                latestSemVer2Package.IsLatestSemVer2 = true;
-                latestSemVer2Package.LastUpdated = currentUtcTime;
-
-                if (latestSemVer2Package.IsPrerelease)
-                {
-                    // If the newest uploaded package is a prerelease package, we need to find an older package that is
-                    // a release version and set it to IsLatest.
-                    var latestSemVer2ReleasePackage = FindPackage(packageRegistration
-                        .Packages
-                        .AsQueryable()
-                        .Where(SemVerLevelKey.IsSemVer2Predicate())
-                        .Where(p => !p.IsPrerelease && p.PackageStatusKey == PackageStatus.Available && p.Listed));
-
-                    if (latestSemVer2ReleasePackage != null)
-                    {
-                        // We could have no release packages
-                        latestSemVer2ReleasePackage.IsLatestStableSemVer2 = true;
-                        latestSemVer2ReleasePackage.LastUpdated = currentUtcTime;
-                    }
-                }
-                else
-                {
-                    // Only release versions are marked as IsLatestStable.
-                    latestSemVer2Package.IsLatestStableSemVer2 = true;
-                }
-            }
-
-            if (commitChanges)
-            {
-                await _packageRepository.CommitChangesAsync();
-            }
-        }
-
-        private static Package FindPackage(IQueryable<Package> packages, Func<IQueryable<Package>, IQueryable<Package>> predicate = null)
-        {
-            if (predicate != null)
-            {
-                packages = predicate(packages);
-            }
-
-            NuGetVersion version = packages.Max(p => new NuGetVersion(p.Version));
-            if (version == null)
-            {
-                return null;
-            }
-
-            return packages.First(pv => pv.Version.Equals(version.OriginalVersion, StringComparison.OrdinalIgnoreCase));
-        }
-
         private PackageOwnerRequest FindExistingPackageOwnerRequest(PackageRegistration package, User pendingOwner)
         {
             return (from request in _packageOwnerRequestRepository.GetAll()
diff --git a/tests/NuGetGallery.Core.Facts/NuGetGallery.Core.Facts.csproj b/tests/NuGetGallery.Core.Facts/NuGetGallery.Core.Facts.csproj
index 64474e4723..bbade9e15b 100644
--- a/tests/NuGetGallery.Core.Facts/NuGetGallery.Core.Facts.csproj
+++ b/tests/NuGetGallery.Core.Facts/NuGetGallery.Core.Facts.csproj
@@ -145,6 +145,7 @@
     <Compile Include="Properties\AssemblyInfo.cs" />
     <Compile Include="Packaging\NupkgRewriterFacts.cs" />
     <Compile Include="SemVerLevelKeyFacts.cs" />
+    <Compile Include="Services\CorePackageServiceFacts.cs" />
     <Compile Include="Utilities\TestDirectory.cs" />
   </ItemGroup>
   <ItemGroup>
diff --git a/tests/NuGetGallery.Core.Facts/Services/CorePackageServiceFacts.cs b/tests/NuGetGallery.Core.Facts/Services/CorePackageServiceFacts.cs
new file mode 100644
index 0000000000..97c0ddc934
--- /dev/null
+++ b/tests/NuGetGallery.Core.Facts/Services/CorePackageServiceFacts.cs
@@ -0,0 +1,454 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Moq;
+using Xunit;
+
+namespace NuGetGallery
+{
+    public class CorePackageServiceFacts
+    {
+        public class TheUpdatePackageStatusMethod
+        {
+            [Fact]
+            public async Task RejectsNullPackage()
+            {
+                // Arrange
+                Package package = null;
+                var service = CreateService();
+
+                // Act & Assert
+                await Assert.ThrowsAsync<ArgumentNullException>(
+                    () => service.UpdatePackageStatusAsync(package, PackageStatus.Deleted, commitChanges: true));
+            }
+
+            [Fact]
+            public async Task RejectsNullPackageRegistration()
+            {
+                // Arrange
+                Package package = new Package
+                {
+                    PackageRegistration = null,
+                };
+                var service = CreateService();
+
+                // Act & Assert
+                await Assert.ThrowsAsync<ArgumentException>(
+                    () => service.UpdatePackageStatusAsync(package, PackageStatus.Deleted, commitChanges: true));
+            }
+
+            [Theory]
+            [InlineData(false, 0)]
+            [InlineData(true, 1)]
+            public async Task CommitsTheCorrectNumberOfTimes(bool commitChanges, int commitCount)
+            {
+                // Arrange
+                var packageRepositoy = new Mock<IEntityRepository<Package>>();
+                var package = new Package
+                {
+                    PackageRegistration = new PackageRegistration(),
+                };
+                var service = CreateService(packageRepository: packageRepositoy);
+
+                // Act
+                await service.UpdatePackageStatusAsync(package, PackageStatus.Available, commitChanges);
+
+                // Assert
+                packageRepositoy.Verify(x => x.CommitChangesAsync(), Times.Exactly(commitCount));
+            }
+
+            [Fact]
+            public async Task SetDeletedBitWhenNewPackageStatusIsAvailable()
+            {
+                // Arrange
+                var service = CreateService();
+                var package = new Package
+                {
+                    PackageStatusKey = PackageStatus.Available,
+#pragma warning disable CS0612 // Type or member is obsolete
+                    Deleted = false,
+#pragma warning restore CS0612 // Type or member is obsolete
+                    PackageRegistration = new PackageRegistration
+                    {
+                        Packages = new List<Package>(),
+                    }
+                };
+                package.PackageRegistration.Packages.Add(package);
+
+                // Act
+                await service.UpdatePackageStatusAsync(package, PackageStatus.Deleted);
+
+                // Assert
+#pragma warning disable CS0612 // Type or member is obsolete
+                Assert.True(package.Deleted);
+#pragma warning restore CS0612 // Type or member is obsolete
+            }
+
+            [Fact]
+            public async Task UpdateCorrectPropertiesWhenBecomingAvailable()
+            {
+                // Arrange
+                var service = CreateService();
+                var package = new Package
+                {
+                    Version = "1.0.0",
+                    PackageStatusKey = PackageStatus.Deleted,
+#pragma warning disable CS0612 // Type or member is obsolete
+                    Deleted = true,
+#pragma warning restore CS0612 // Type or member is obsolete
+                    PackageRegistration = new PackageRegistration
+                    {
+                        Packages = new List<Package>(),
+                    },
+                    IsLatest = false,
+                    IsLatestStable = false,
+                    IsLatestSemVer2 = false,
+                    IsLatestStableSemVer2 = false,
+                    SemVerLevelKey = SemVerLevelKey.Unknown,
+                    LastEdited = DateTime.MinValue,
+                    LastUpdated = DateTime.MinValue,
+                };
+                package.PackageRegistration.Packages.Add(package);
+
+                // Act
+                var before = DateTime.UtcNow;
+                await service.UpdatePackageStatusAsync(package, PackageStatus.Available);
+                var after = DateTime.UtcNow;
+
+                // Assert
+#pragma warning disable CS0612 // Type or member is obsolete
+                Assert.False(package.Deleted, $"{nameof(Package.Deleted)} should be false.");
+#pragma warning restore CS0612 // Type or member is obsolete
+                Assert.Equal(PackageStatus.Available, package.PackageStatusKey);
+                Assert.True(package.IsLatest, $"{nameof(Package.IsLatest)} should be true.");
+                Assert.True(package.IsLatestStable, $"{nameof(Package.IsLatestStable)} should be true.");
+                Assert.True(package.IsLatestSemVer2, $"{nameof(Package.IsLatestSemVer2)} should be true.");
+                Assert.True(package.IsLatestStableSemVer2, $"{nameof(Package.IsLatestStableSemVer2)} should be true.");
+                Assert.NotNull(package.LastEdited);
+                Assert.InRange(package.LastEdited.Value, before, after);
+                Assert.InRange(package.LastUpdated, before, after);
+            }
+
+            [Fact]
+            public async Task DoesNotUpdateLatestPropertiesWhenNoLatestAndNotBecomingAvailable()
+            {
+                // Arrange
+                var service = CreateService();
+                var package = new Package
+                {
+                    PackageStatusKey = PackageStatus.Available,
+#pragma warning disable CS0612 // Type or member is obsolete
+                    Deleted = false,
+#pragma warning restore CS0612 // Type or member is obsolete
+                    PackageRegistration = new PackageRegistration
+                    {
+                        Packages = new List<Package>(),
+                    },
+                    IsLatest = false,
+                    IsLatestStable = false,
+                    IsLatestSemVer2 = false,
+                    IsLatestStableSemVer2 = false,
+                    SemVerLevelKey = SemVerLevelKey.Unknown,
+                };
+                package.PackageRegistration.Packages.Add(package);
+
+                // Act
+                var before = DateTime.UtcNow;
+                await service.UpdatePackageStatusAsync(package, PackageStatus.Deleted);
+                var after = DateTime.UtcNow;
+
+                // Assert
+                Assert.False(package.IsLatest, $"{nameof(Package.IsLatest)} should be false.");
+                Assert.False(package.IsLatestStable, $"{nameof(Package.IsLatestStable)} should be false.");
+                Assert.False(package.IsLatestSemVer2, $"{nameof(Package.IsLatestSemVer2)} should be false.");
+                Assert.False(package.IsLatestStableSemVer2, $"{nameof(Package.IsLatestStableSemVer2)} should be false.");
+                Assert.Null(package.LastEdited);
+                Assert.InRange(package.LastUpdated, before, after);
+            }
+
+            [Fact]
+            public async Task DoesNotUpdateLastEditedWhenBecomingUnavailable()
+            {
+                // Arrange
+                var service = CreateService();
+                var package = new Package
+                {
+                    PackageStatusKey = PackageStatus.Available,
+                    PackageRegistration = new PackageRegistration
+                    {
+                        Packages = new List<Package>(),
+                    },
+                };
+                package.PackageRegistration.Packages.Add(package);
+
+                // Act
+                await service.UpdatePackageStatusAsync(package, PackageStatus.Deleted);
+
+                // Assert
+                Assert.Null(package.LastEdited);
+            }
+        }
+
+        public class TheUpdateIsLatestMethod
+        {
+            [Fact]
+            public async Task DoNotCommitIfCommitChangesIsFalse()
+            {
+                // Arrange
+                var packageRegistration = new PackageRegistration();
+                var package = new Package { PackageRegistration = packageRegistration, Version = "1.0.0" };
+                packageRegistration.Packages.Add(package);
+                var packageRepository = new Mock<IEntityRepository<Package>>();
+
+                var service = CreateService(packageRepository: packageRepository);
+
+                // Act
+                await service.UpdateIsLatestAsync(packageRegistration, commitChanges: false);
+
+                // Assert
+                packageRepository.Verify(r => r.CommitChangesAsync(), Times.Never());
+            }
+
+            [Fact]
+            public async Task CommitIfCommitChangesIsTrue()
+            {
+                // Arrange
+                var packageRegistration = new PackageRegistration();
+                var package = new Package { PackageRegistration = packageRegistration, Version = "1.0.0" };
+                packageRegistration.Packages.Add(package);
+                var packageRepository = new Mock<IEntityRepository<Package>>();
+
+                var service = CreateService(packageRepository: packageRepository);
+
+                // Act
+                await service.UpdateIsLatestAsync(packageRegistration, true);
+
+                // Assert
+                packageRepository.Verify(r => r.CommitChangesAsync(), Times.Once());
+            }
+
+            [Fact]
+            public async Task ResetsCurrentLatestPackageVersionsBeforeUpdate()
+            {
+                // Arrange
+                var packageRegistration = new PackageRegistration();
+
+                var previousLatestStable = new Package { PackageRegistration = packageRegistration, Version = "1.0.0", IsLatestStable = true };
+                packageRegistration.Packages.Add(previousLatestStable);
+                var previousLatest = new Package { PackageRegistration = packageRegistration, Version = "1.0.0-alpha", IsLatest = true, IsPrerelease = true };
+                packageRegistration.Packages.Add(previousLatest);
+                var previousLatestStableSemVer2 = new Package { PackageRegistration = packageRegistration, Version = "1.0.1+metadata", IsLatestStableSemVer2 = true, SemVerLevelKey = SemVerLevelKey.SemVer2 };
+                packageRegistration.Packages.Add(previousLatestStableSemVer2);
+                var previousLatestSemVer2 = new Package { PackageRegistration = packageRegistration, Version = "1.0.1-alpha.1", IsLatestSemVer2 = true, IsPrerelease = true, SemVerLevelKey = SemVerLevelKey.SemVer2 };
+                packageRegistration.Packages.Add(previousLatestSemVer2);
+
+                // Simulates adding newer versions, to ensure the previous latest are no longer latest at end of test.
+                var newLatestStable = new Package { PackageRegistration = packageRegistration, Version = "1.0.1", IsLatestStable = true };
+                packageRegistration.Packages.Add(newLatestStable);
+                var newLatest = new Package { PackageRegistration = packageRegistration, Version = "1.0.2-alpha", IsLatest = true, IsPrerelease = true };
+                packageRegistration.Packages.Add(newLatest);
+                var newLatestStableSemVer2 = new Package { PackageRegistration = packageRegistration, Version = "1.0.2+metadata", IsLatestStableSemVer2 = true, SemVerLevelKey = SemVerLevelKey.SemVer2 };
+                packageRegistration.Packages.Add(newLatestStableSemVer2);
+                var newLatestSemVer2 = new Package { PackageRegistration = packageRegistration, Version = "1.0.3-alpha.1", IsLatestSemVer2 = true, IsPrerelease = true, SemVerLevelKey = SemVerLevelKey.SemVer2 };
+                packageRegistration.Packages.Add(newLatestSemVer2);
+
+                var packageRepository = new Mock<IEntityRepository<Package>>();
+
+                var service = CreateService(packageRepository: packageRepository);
+
+                // Act
+                await service.UpdateIsLatestAsync(packageRegistration, commitChanges: true);
+
+                // Assert
+                Assert.False(previousLatestStable.IsLatestStable);
+                Assert.False(previousLatest.IsLatest);
+                Assert.False(previousLatestSemVer2.IsLatestSemVer2);
+                Assert.False(previousLatestStableSemVer2.IsLatestStableSemVer2);
+
+                Assert.True(newLatestStable.IsLatestStable);
+                Assert.True(newLatest.IsLatest);
+                Assert.True(newLatestSemVer2.IsLatestSemVer2);
+                Assert.True(newLatestStableSemVer2.IsLatestStableSemVer2);
+            }
+
+            [Fact]
+            public async Task UpdateIsLatestScenarioForPrereleaseAsAbsoluteLatest()
+            {
+                // Arrange
+                var packages = new HashSet<Package>();
+                var packageRegistration = new PackageRegistration { Packages = packages };
+                var package10A = new Package { PackageRegistration = packageRegistration, Version = "1.0.0-a", IsPrerelease = true };
+                packages.Add(package10A);
+                var package09 = new Package { PackageRegistration = packageRegistration, Version = "0.9.0" };
+                packages.Add(package09);
+                var packageRepository = new Mock<IEntityRepository<Package>>(MockBehavior.Strict);
+                packageRepository.Setup(r => r.CommitChangesAsync())
+                    .Returns(Task.FromResult(0)).Verifiable();
+                var service = CreateService(packageRepository: packageRepository);
+
+                // Act
+                await service.UpdateIsLatestAsync(packageRegistration, true);
+
+                // Assert
+                Assert.True(package10A.IsLatest);
+                Assert.True(package10A.IsLatestSemVer2);
+                Assert.False(package10A.IsLatestStable);
+                Assert.False(package10A.IsLatestStableSemVer2);
+
+                Assert.False(package09.IsLatest);
+                Assert.False(package09.IsLatestSemVer2);
+                Assert.True(package09.IsLatestStable);
+                Assert.True(package09.IsLatestStableSemVer2);
+
+                packageRepository.Verify();
+            }
+
+            [Fact]
+            public async Task UpdateIsLatestScenarioForStableAsAbsoluteLatest()
+            {
+                // Arrange
+                var packages = new HashSet<Package>();
+                var packageRegistration = new PackageRegistration { Packages = packages };
+                var package100 = new Package { PackageRegistration = packageRegistration, Version = "1.0.0" };
+                packages.Add(package100);
+                var package10A = new Package { PackageRegistration = packageRegistration, Version = "1.0.0-a", IsPrerelease = true };
+                packages.Add(package10A);
+                var package09 = new Package { PackageRegistration = packageRegistration, Version = "0.9.0" };
+                packages.Add(package09);
+                var packageRepository = new Mock<IEntityRepository<Package>>(MockBehavior.Strict);
+                packageRepository.Setup(r => r.CommitChangesAsync())
+                    .Returns(Task.FromResult(0)).Verifiable();
+                var service = CreateService(packageRepository: packageRepository);
+
+                // Act
+                await service.UpdateIsLatestAsync(packageRegistration, true);
+
+                // Assert
+                Assert.True(package100.IsLatest);
+                Assert.True(package100.IsLatestSemVer2);
+                Assert.True(package100.IsLatestStable);
+                Assert.True(package100.IsLatestStableSemVer2);
+
+                Assert.False(package10A.IsLatest);
+                Assert.False(package10A.IsLatestSemVer2);
+                Assert.False(package10A.IsLatestStable);
+                Assert.False(package10A.IsLatestStableSemVer2);
+
+                Assert.False(package09.IsLatest);
+                Assert.False(package09.IsLatestSemVer2);
+                Assert.False(package09.IsLatestStable);
+                Assert.False(package09.IsLatestStableSemVer2);
+
+                packageRepository.Verify();
+            }
+
+            [Fact]
+            public async Task UpdateIsLatestScenarioForSemVer2PrereleaseAsAbsoluteLatest()
+            {
+                // Arrange
+                var packages = new HashSet<Package>();
+                var packageRegistration = new PackageRegistration { Packages = packages };
+                var semVer2Package = new Package { PackageRegistration = packageRegistration, Version = "1.0.1-alpha.1", IsPrerelease = true, SemVerLevelKey = SemVerLevelKey.SemVer2 };
+                packages.Add(semVer2Package);
+                var package100 = new Package { PackageRegistration = packageRegistration, Version = "1.0.0" };
+                packages.Add(package100);
+                var package10A = new Package { PackageRegistration = packageRegistration, Version = "1.0.0-a", IsPrerelease = true };
+                packages.Add(package10A);
+                var package09 = new Package { PackageRegistration = packageRegistration, Version = "0.9.0" };
+                packages.Add(package09);
+                var packageRepository = new Mock<IEntityRepository<Package>>(MockBehavior.Strict);
+                packageRepository.Setup(r => r.CommitChangesAsync())
+                    .Returns(Task.FromResult(0)).Verifiable();
+                var service = CreateService(packageRepository: packageRepository);
+
+                // Act
+                await service.UpdateIsLatestAsync(packageRegistration, true);
+
+                // Assert
+                Assert.True(semVer2Package.IsLatestSemVer2);
+                Assert.False(semVer2Package.IsLatestStableSemVer2);
+                Assert.False(semVer2Package.IsLatest);
+                Assert.False(semVer2Package.IsLatestStable);
+
+                Assert.True(package100.IsLatest);
+                Assert.False(package100.IsLatestSemVer2);
+                Assert.True(package100.IsLatestStable);
+                Assert.True(package100.IsLatestStableSemVer2);
+
+                Assert.False(package10A.IsLatest);
+                Assert.False(package10A.IsLatestSemVer2);
+                Assert.False(package10A.IsLatestStable);
+                Assert.False(package10A.IsLatestStableSemVer2);
+
+                Assert.False(package09.IsLatest);
+                Assert.False(package09.IsLatestSemVer2);
+                Assert.False(package09.IsLatestStable);
+                Assert.False(package09.IsLatestStableSemVer2);
+
+                packageRepository.Verify();
+            }
+
+            [Fact]
+            public async Task UpdateIsLatestScenarioForSemVer2StableAsAbsoluteLatest()
+            {
+                // Arrange
+                var packages = new HashSet<Package>();
+                var packageRegistration = new PackageRegistration { Packages = packages };
+                var semVer2Package = new Package { PackageRegistration = packageRegistration, Version = "1.0.1+metadata", SemVerLevelKey = SemVerLevelKey.SemVer2 };
+                packages.Add(semVer2Package);
+                var package100 = new Package { PackageRegistration = packageRegistration, Version = "1.0.0" };
+                packages.Add(package100);
+                var package10A = new Package { PackageRegistration = packageRegistration, Version = "1.0.0-a", IsPrerelease = true };
+                packages.Add(package10A);
+                var package09 = new Package { PackageRegistration = packageRegistration, Version = "0.9.0" };
+                packages.Add(package09);
+                var packageRepository = new Mock<IEntityRepository<Package>>(MockBehavior.Strict);
+                packageRepository.Setup(r => r.CommitChangesAsync())
+                    .Returns(Task.FromResult(0)).Verifiable();
+                var service = CreateService(packageRepository: packageRepository);
+
+                // Act
+                await service.UpdateIsLatestAsync(packageRegistration, true);
+
+                // Assert
+                Assert.True(semVer2Package.IsLatestSemVer2);
+                Assert.True(semVer2Package.IsLatestStableSemVer2);
+                Assert.False(semVer2Package.IsLatest);
+                Assert.False(semVer2Package.IsLatestStable);
+
+                Assert.True(package100.IsLatest);
+                Assert.False(package100.IsLatestSemVer2);
+                Assert.True(package100.IsLatestStable);
+                Assert.False(package100.IsLatestStableSemVer2);
+
+                Assert.False(package10A.IsLatest);
+                Assert.False(package10A.IsLatestSemVer2);
+                Assert.False(package10A.IsLatestStable);
+                Assert.False(package10A.IsLatestStableSemVer2);
+
+                Assert.False(package09.IsLatest);
+                Assert.False(package09.IsLatestSemVer2);
+                Assert.False(package09.IsLatestStable);
+                Assert.False(package09.IsLatestStableSemVer2);
+
+                packageRepository.Verify();
+            }
+        }
+
+        private static ICorePackageService CreateService(
+            Mock<IEntityRepository<Package>> packageRepository = null)
+        {
+            packageRepository = packageRepository ?? new Mock<IEntityRepository<Package>>();
+            
+            var packageService = new Mock<CorePackageService>(
+                packageRepository.Object);
+
+            packageService.CallBase = true;
+
+            return packageService.Object;
+        }
+    }
+}
diff --git a/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
index f3d5b248f8..d12de71933 100644
--- a/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
@@ -107,7 +107,7 @@ public async Task WillIncreaseTheDatabaseCommandTimeout()
             }
 
             [Fact]
-            public async Task WillUpdateThePackage()
+            public async Task WillMarkThePackageAsUnlisted()
             {
                 var packageDeletesRepo = new Mock<IEntityRepository<PackageDelete>>();
                 var service = CreateService(packageDeletesRepository: packageDeletesRepo);
@@ -121,10 +121,6 @@ public async Task WillUpdateThePackage()
                 await service.SoftDeletePackagesAsync(new[] { package }, user, reason, signature);
 
                 Assert.False(package.Listed);
-#pragma warning disable CS0612 // Type or member is obsolete
-                Assert.True(package.Deleted);
-#pragma warning restore CS0612 // Type or member is obsolete
-                Assert.Equal(PackageStatus.Deleted, package.PackageStatusKey);
             }
 
             [Fact]
@@ -157,18 +153,14 @@ public async Task WillUpdateThePackageRepository()
                 var user = new User("test");
 
                 await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
-
-#pragma warning disable CS0612 // Type or member is obsolete
-                Assert.True(package.Deleted);
-#pragma warning restore CS0612 // Type or member is obsolete
-                Assert.Equal(PackageStatus.Deleted, package.PackageStatusKey);
+                
                 packageRepository.Verify(x => x.CommitChangesAsync());
                 packageDeleteRepository.Verify(x => x.InsertOnCommit(It.IsAny<PackageDelete>()));
                 packageDeleteRepository.Verify(x => x.CommitChangesAsync());
             }
 
             [Fact]
-            public async Task WillUpdatePackageLatestVersions()
+            public async Task WillUpdatePackageStatusToDeleted()
             {
                 var packageService = new Mock<IPackageService>();
                 var service = CreateService(packageService: packageService);
@@ -179,7 +171,7 @@ public async Task WillUpdatePackageLatestVersions()
 
                 await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
 
-                packageService.Verify(x => x.UpdateIsLatestAsync(packageRegistration, false));
+                packageService.Verify(x => x.UpdatePackageStatusAsync(package, PackageStatus.Deleted, false));
             }
 
             [Fact]
diff --git a/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
index b322b9a7c6..b464544b79 100644
--- a/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
@@ -12,14 +12,13 @@
 using NuGetGallery.Auditing;
 using NuGetGallery.Framework;
 using NuGetGallery.Packaging;
-using Xunit;
 using NuGetGallery.TestUtils;
+using Xunit;
 
 namespace NuGetGallery
 {
     public class PackageServiceFacts
     {
-
         private static IPackageService CreateService(
             Mock<IEntityRepository<PackageRegistration>> packageRegistrationRepository = null,
             Mock<IEntityRepository<Package>> packageRepository = null,
@@ -888,252 +887,6 @@ public async Task ReturnsExistingMatchingPackageOwnerRequest()
             }
         }
 
-        public class TheUpdateIsLatestMethod
-        {
-            [Fact]
-            public async Task DoNotCommitIfCommitChangesIsFalse()
-            {
-                // Arrange
-                var packageRegistration = new PackageRegistration();
-                var package = new Package { PackageRegistration = packageRegistration, Version = "1.0.0" };
-                packageRegistration.Packages.Add(package);
-                var packageRepository = new Mock<IEntityRepository<Package>>();
-
-                var service = CreateService(packageRepository: packageRepository);
-
-                // Act
-                await service.UpdateIsLatestAsync(packageRegistration, commitChanges: false);
-
-                // Assert
-                packageRepository.Verify(r => r.CommitChangesAsync(), Times.Never());
-            }
-
-            [Fact]
-            public async Task CommitIfCommitChangesIsTrue()
-            {
-                // Arrange
-                var packageRegistration = new PackageRegistration();
-                var package = new Package { PackageRegistration = packageRegistration, Version = "1.0.0" };
-                packageRegistration.Packages.Add(package);
-                var packageRepository = new Mock<IEntityRepository<Package>>();
-
-                var service = CreateService(packageRepository: packageRepository);
-
-                // Act
-                await service.UpdateIsLatestAsync(packageRegistration, true);
-
-                // Assert
-                packageRepository.Verify(r => r.CommitChangesAsync(), Times.Once());
-            }
-
-            [Fact]
-            public async Task ResetsCurrentLatestPackageVersionsBeforeUpdate()
-            {
-                // Arrange
-                var packageRegistration = new PackageRegistration();
-
-                var previousLatestStable = new Package { PackageRegistration = packageRegistration, Version = "1.0.0", IsLatestStable = true };
-                packageRegistration.Packages.Add(previousLatestStable);
-                var previousLatest = new Package { PackageRegistration = packageRegistration, Version = "1.0.0-alpha", IsLatest = true, IsPrerelease = true };
-                packageRegistration.Packages.Add(previousLatest);
-                var previousLatestStableSemVer2 = new Package { PackageRegistration = packageRegistration, Version = "1.0.1+metadata", IsLatestStableSemVer2 = true, SemVerLevelKey = SemVerLevelKey.SemVer2 };
-                packageRegistration.Packages.Add(previousLatestStableSemVer2);
-                var previousLatestSemVer2 = new Package { PackageRegistration = packageRegistration, Version = "1.0.1-alpha.1", IsLatestSemVer2 = true, IsPrerelease = true, SemVerLevelKey = SemVerLevelKey.SemVer2 };
-                packageRegistration.Packages.Add(previousLatestSemVer2);
-
-                // Simulates adding newer versions, to ensure the previous latest are no longer latest at end of test.
-                var newLatestStable = new Package { PackageRegistration = packageRegistration, Version = "1.0.1", IsLatestStable = true };
-                packageRegistration.Packages.Add(newLatestStable);
-                var newLatest = new Package { PackageRegistration = packageRegistration, Version = "1.0.2-alpha", IsLatest = true, IsPrerelease = true };
-                packageRegistration.Packages.Add(newLatest);
-                var newLatestStableSemVer2 = new Package { PackageRegistration = packageRegistration, Version = "1.0.2+metadata", IsLatestStableSemVer2 = true, SemVerLevelKey = SemVerLevelKey.SemVer2 };
-                packageRegistration.Packages.Add(newLatestStableSemVer2);
-                var newLatestSemVer2 = new Package { PackageRegistration = packageRegistration, Version = "1.0.3-alpha.1", IsLatestSemVer2 = true, IsPrerelease = true, SemVerLevelKey = SemVerLevelKey.SemVer2 };
-                packageRegistration.Packages.Add(newLatestSemVer2);
-
-                var packageRepository = new Mock<IEntityRepository<Package>>();
-
-                var service = CreateService(packageRepository: packageRepository);
-
-                // Act
-                await service.UpdateIsLatestAsync(packageRegistration, commitChanges: true);
-
-                // Assert
-                Assert.False(previousLatestStable.IsLatestStable);
-                Assert.False(previousLatest.IsLatest);
-                Assert.False(previousLatestSemVer2.IsLatestSemVer2);
-                Assert.False(previousLatestStableSemVer2.IsLatestStableSemVer2);
-                
-                Assert.True(newLatestStable.IsLatestStable);
-                Assert.True(newLatest.IsLatest);
-                Assert.True(newLatestSemVer2.IsLatestSemVer2);
-                Assert.True(newLatestStableSemVer2.IsLatestStableSemVer2);
-            }
-
-            [Fact]
-            public async Task UpdateIsLatestScenarioForPrereleaseAsAbsoluteLatest()
-            {
-                // Arrange
-                var packages = new HashSet<Package>();
-                var packageRegistration = new PackageRegistration { Packages = packages };
-                var package10A = new Package { PackageRegistration = packageRegistration, Version = "1.0.0-a", IsPrerelease = true };
-                packages.Add(package10A);
-                var package09 = new Package { PackageRegistration = packageRegistration, Version = "0.9.0" };
-                packages.Add(package09);
-                var packageRepository = new Mock<IEntityRepository<Package>>(MockBehavior.Strict);
-                packageRepository.Setup(r => r.CommitChangesAsync())
-                    .Returns(Task.CompletedTask).Verifiable();
-                var service = CreateService(packageRepository: packageRepository);
-
-                // Act
-                await service.UpdateIsLatestAsync(packageRegistration, true);
-
-                // Assert
-                Assert.True(package10A.IsLatest);
-                Assert.True(package10A.IsLatestSemVer2);
-                Assert.False(package10A.IsLatestStable);
-                Assert.False(package10A.IsLatestStableSemVer2);
-
-                Assert.False(package09.IsLatest);
-                Assert.False(package09.IsLatestSemVer2);
-                Assert.True(package09.IsLatestStable);
-                Assert.True(package09.IsLatestStableSemVer2);
-
-                packageRepository.Verify();
-            }
-
-            [Fact]
-            public async Task UpdateIsLatestScenarioForStableAsAbsoluteLatest()
-            {
-                // Arrange
-                var packages = new HashSet<Package>();
-                var packageRegistration = new PackageRegistration { Packages = packages };
-                var package100 = new Package { PackageRegistration = packageRegistration, Version = "1.0.0" };
-                packages.Add(package100);
-                var package10A = new Package { PackageRegistration = packageRegistration, Version = "1.0.0-a", IsPrerelease = true };
-                packages.Add(package10A);
-                var package09 = new Package { PackageRegistration = packageRegistration, Version = "0.9.0" };
-                packages.Add(package09);
-                var packageRepository = new Mock<IEntityRepository<Package>>(MockBehavior.Strict);
-                packageRepository.Setup(r => r.CommitChangesAsync())
-                    .Returns(Task.CompletedTask).Verifiable();
-                var service = CreateService(packageRepository: packageRepository);
-
-                // Act
-                await service.UpdateIsLatestAsync(packageRegistration, true);
-
-                // Assert
-                Assert.True(package100.IsLatest);
-                Assert.True(package100.IsLatestSemVer2);
-                Assert.True(package100.IsLatestStable);
-                Assert.True(package100.IsLatestStableSemVer2);
-
-                Assert.False(package10A.IsLatest);
-                Assert.False(package10A.IsLatestSemVer2);
-                Assert.False(package10A.IsLatestStable);
-                Assert.False(package10A.IsLatestStableSemVer2);
-
-                Assert.False(package09.IsLatest);
-                Assert.False(package09.IsLatestSemVer2);
-                Assert.False(package09.IsLatestStable);
-                Assert.False(package09.IsLatestStableSemVer2);
-
-                packageRepository.Verify();
-            }
-
-            [Fact]
-            public async Task UpdateIsLatestScenarioForSemVer2PrereleaseAsAbsoluteLatest()
-            {
-                // Arrange
-                var packages = new HashSet<Package>();
-                var packageRegistration = new PackageRegistration { Packages = packages };
-                var semVer2Package = new Package { PackageRegistration = packageRegistration, Version = "1.0.1-alpha.1", IsPrerelease = true, SemVerLevelKey = SemVerLevelKey.SemVer2 };
-                packages.Add(semVer2Package);
-                var package100 = new Package { PackageRegistration = packageRegistration, Version = "1.0.0" };
-                packages.Add(package100);
-                var package10A = new Package { PackageRegistration = packageRegistration, Version = "1.0.0-a", IsPrerelease = true };
-                packages.Add(package10A);
-                var package09 = new Package { PackageRegistration = packageRegistration, Version = "0.9.0" };
-                packages.Add(package09);
-                var packageRepository = new Mock<IEntityRepository<Package>>(MockBehavior.Strict);
-                packageRepository.Setup(r => r.CommitChangesAsync())
-                    .Returns(Task.CompletedTask).Verifiable();
-                var service = CreateService(packageRepository: packageRepository);
-
-                // Act
-                await service.UpdateIsLatestAsync(packageRegistration, true);
-
-                // Assert
-                Assert.True(semVer2Package.IsLatestSemVer2);
-                Assert.False(semVer2Package.IsLatestStableSemVer2);
-                Assert.False(semVer2Package.IsLatest);
-                Assert.False(semVer2Package.IsLatestStable);
-
-                Assert.True(package100.IsLatest);
-                Assert.False(package100.IsLatestSemVer2);
-                Assert.True(package100.IsLatestStable);
-                Assert.True(package100.IsLatestStableSemVer2);
-
-                Assert.False(package10A.IsLatest);
-                Assert.False(package10A.IsLatestSemVer2);
-                Assert.False(package10A.IsLatestStable);
-                Assert.False(package10A.IsLatestStableSemVer2);
-
-                Assert.False(package09.IsLatest);
-                Assert.False(package09.IsLatestSemVer2);
-                Assert.False(package09.IsLatestStable);
-                Assert.False(package09.IsLatestStableSemVer2);
-
-                packageRepository.Verify();
-            }
-
-            [Fact]
-            public async Task UpdateIsLatestScenarioForSemVer2StableAsAbsoluteLatest()
-            {
-                // Arrange
-                var packages = new HashSet<Package>();
-                var packageRegistration = new PackageRegistration { Packages = packages };
-                var semVer2Package = new Package { PackageRegistration = packageRegistration, Version = "1.0.1+metadata", SemVerLevelKey = SemVerLevelKey.SemVer2 };
-                packages.Add(semVer2Package);
-                var package100 = new Package { PackageRegistration = packageRegistration, Version = "1.0.0" };
-                packages.Add(package100);
-                var package10A = new Package { PackageRegistration = packageRegistration, Version = "1.0.0-a", IsPrerelease = true };
-                packages.Add(package10A);
-                var package09 = new Package { PackageRegistration = packageRegistration, Version = "0.9.0" };
-                packages.Add(package09);
-                var packageRepository = new Mock<IEntityRepository<Package>>(MockBehavior.Strict);
-                packageRepository.Setup(r => r.CommitChangesAsync())
-                    .Returns(Task.CompletedTask).Verifiable();
-                var service = CreateService(packageRepository: packageRepository);
-
-                // Act
-                await service.UpdateIsLatestAsync(packageRegistration, true);
-
-                // Assert
-                Assert.True(semVer2Package.IsLatestSemVer2);
-                Assert.True(semVer2Package.IsLatestStableSemVer2);
-                Assert.False(semVer2Package.IsLatest);
-                Assert.False(semVer2Package.IsLatestStable);
-
-                Assert.True(package100.IsLatest);
-                Assert.False(package100.IsLatestSemVer2);
-                Assert.True(package100.IsLatestStable);
-                Assert.False(package100.IsLatestStableSemVer2);
-
-                Assert.False(package10A.IsLatest);
-                Assert.False(package10A.IsLatestSemVer2);
-                Assert.False(package10A.IsLatestStable);
-                Assert.False(package10A.IsLatestStableSemVer2);
-
-                Assert.False(package09.IsLatest);
-                Assert.False(package09.IsLatestSemVer2);
-                Assert.False(package09.IsLatestStable);
-                Assert.False(package09.IsLatestStableSemVer2);
-
-                packageRepository.Verify();
-            }
-        }
-
         public class TheFindPackageByIdAndVersionMethod
         {
             [Fact]

From 2ff68a0082a0dfbbfd5d7b484f632aa1d499d4b3 Mon Sep 17 00:00:00 2001
From: Christy Henriksson <chenriks@microsoft.com>
Date: Mon, 25 Sep 2017 10:33:52 -0700
Subject: [PATCH 03/25] Hide readme form on validation errors (#4711)

---
 .../Scripts/gallery/async-file-upload.js      | 91 +++++++++----------
 .../Scripts/gallery/page-edit-readme.js       | 11 ++-
 src/NuGetGallery/Scripts/gallery/page-edit.js | 73 ++++++++-------
 .../Views/Packages/_EditMetadata.cshtml       |  2 +-
 4 files changed, 90 insertions(+), 87 deletions(-)

diff --git a/src/NuGetGallery/Scripts/gallery/async-file-upload.js b/src/NuGetGallery/Scripts/gallery/async-file-upload.js
index e25bc92cf1..3dabacf932 100644
--- a/src/NuGetGallery/Scripts/gallery/async-file-upload.js
+++ b/src/NuGetGallery/Scripts/gallery/async-file-upload.js
@@ -211,53 +211,52 @@ var AsyncFileUploadManager = new function () {
         $("#submit-block").remove();
         $("#verify-collapser-container").addClass("hidden");
         $("#submit-collapser-container").addClass("hidden");
-        if (model == null) {
-            return;
-        }
-
-        var reportContainerElement = document.createElement("div");
-        $(reportContainerElement).attr("id", "verify-package-block");
-        $(reportContainerElement).attr("class", "collapse in");
-        $(reportContainerElement).attr("aria-expanded", "true");
-        $(reportContainerElement).attr("data-bind", "template: { name: 'edit-metadata-template', data: data }");
-        $("#verify-package-container").append(reportContainerElement);
-        ko.applyBindings({ data: model }, reportContainerElement);
-
-        var submitContainerElement = document.createElement("div");
-        $(submitContainerElement).attr("id", "submit-block");
-        $(submitContainerElement).attr("class", "collapse in");
-        $(submitContainerElement).attr("aria-expanded", "true");
-        $(submitContainerElement).attr("data-bind", "template: { name: 'submit-package-template', data: data }");
-        $("#submit-package-container").append(submitContainerElement);
-        ko.applyBindings({ data: model }, submitContainerElement);
-
-        $('#verify-cancel-button').on('click', function () {
-            $('#verify-cancel-button').attr('disabled', 'disabled');
-            $('#verify-cancel-button').attr('value', 'Cancelling');
-            $('#verify-cancel-button').addClass('.loading');
-            $('#verify-submit-button').attr('disabled', 'disabled');
-            $('#input-select-file').val("");
-            resetFileSelectFeedback();
-            cancelUploadAsync();
-        });
-
-        $('#verify-submit-button').on('click', function () {
-            $('#verify-cancel-button').attr('disabled', 'disabled');
-            $('#verify-submit-button').attr('disabled', 'disabled');
-            $('#verify-submit-button').attr('value', 'Submitting');
-            $('#verify-submit-button').addClass('.loading');
-            submitVerifyAsync(navigateToPage);
-        });
 
-        $('#iconurl-field').on('change', function () {
-            $('#icon-preview').attr('src', $('#iconurl-field').val());
-        });
-
-        $("#verify-collapser-container").removeClass("hidden");
-        $("#submit-collapser-container").removeClass("hidden");
-
-        window.nuget.configureExpanderHeading("verify-package-form");
-        window.nuget.configureExpanderHeading("submit-package-form");
+        if (model != null) {
+            var reportContainerElement = document.createElement("div");
+            $(reportContainerElement).attr("id", "verify-package-block");
+            $(reportContainerElement).attr("class", "collapse in");
+            $(reportContainerElement).attr("aria-expanded", "true");
+            $(reportContainerElement).attr("data-bind", "template: { name: 'edit-metadata-template', data: data }");
+            $("#verify-package-container").append(reportContainerElement);
+            ko.applyBindings({ data: model }, reportContainerElement);
+
+            var submitContainerElement = document.createElement("div");
+            $(submitContainerElement).attr("id", "submit-block");
+            $(submitContainerElement).attr("class", "collapse in");
+            $(submitContainerElement).attr("aria-expanded", "true");
+            $(submitContainerElement).attr("data-bind", "template: { name: 'submit-package-template', data: data }");
+            $("#submit-package-container").append(submitContainerElement);
+            ko.applyBindings({ data: model }, submitContainerElement);
+
+            $('#verify-cancel-button').on('click', function () {
+                $('#verify-cancel-button').attr('disabled', 'disabled');
+                $('#verify-cancel-button').attr('value', 'Cancelling');
+                $('#verify-cancel-button').addClass('.loading');
+                $('#verify-submit-button').attr('disabled', 'disabled');
+                $('#input-select-file').val("");
+                resetFileSelectFeedback();
+                cancelUploadAsync();
+            });
+
+            $('#verify-submit-button').on('click', function () {
+                $('#verify-cancel-button').attr('disabled', 'disabled');
+                $('#verify-submit-button').attr('disabled', 'disabled');
+                $('#verify-submit-button').attr('value', 'Submitting');
+                $('#verify-submit-button').addClass('.loading');
+                submitVerifyAsync(navigateToPage);
+            });
+
+            $('#iconurl-field').on('change', function () {
+                $('#icon-preview').attr('src', $('#iconurl-field').val());
+            });
+
+            $("#verify-collapser-container").removeClass("hidden");
+            $("#submit-collapser-container").removeClass("hidden");
+
+            window.nuget.configureExpanderHeading("verify-package-form");
+            window.nuget.configureExpanderHeading("submit-package-form");
+        }
 
         bindReadMeData(model);
     }
diff --git a/src/NuGetGallery/Scripts/gallery/page-edit-readme.js b/src/NuGetGallery/Scripts/gallery/page-edit-readme.js
index b08404a03a..d98ac0f6a2 100644
--- a/src/NuGetGallery/Scripts/gallery/page-edit-readme.js
+++ b/src/NuGetGallery/Scripts/gallery/page-edit-readme.js
@@ -1,15 +1,20 @@
 'use strict';
 
 function bindReadMeData(model) {
+    $("#import-readme-block").remove();
+    $("#readme-collapser-container").addClass("hidden");
+
+    if (model == null)
+    {
+        return;
+    }
+
     model.SelectedTab = ko.observable('written');
     model.OnReadmeTabChange = function (_, e) {
         model.SelectedTab($(e.target).data('source-type'));
         return true;
     };
 
-    $("#import-readme-block").remove();
-    $("#readme-collapser-container").addClass("hidden");
-
     var readMeContainerElement = document.createElement("div");
     $(readMeContainerElement).attr("id", "import-readme-block");
     $(readMeContainerElement).attr("class", "collapse in");
diff --git a/src/NuGetGallery/Scripts/gallery/page-edit.js b/src/NuGetGallery/Scripts/gallery/page-edit.js
index 676e84fcf4..ea40d7e349 100644
--- a/src/NuGetGallery/Scripts/gallery/page-edit.js
+++ b/src/NuGetGallery/Scripts/gallery/page-edit.js
@@ -144,44 +144,43 @@ var EditViewManager = new function () {
     function bindData(model) {
         $("#verify-package-block").remove();
         $("#verify-collapser-container").addClass("hidden");
-        if (model == null) {
-            return;
-        }
-
-        var reportContainerElement = document.createElement("div");
-        $(reportContainerElement).attr("id", "verify-package-block");
-        $(reportContainerElement).attr("class", "collapse in");
-        $(reportContainerElement).attr("aria-expanded", "true");
-        $(reportContainerElement).attr("data-bind", "template: { name: 'edit-metadata-template', data: data }");
-        $("#verify-package-container").append(reportContainerElement);
-        ko.applyBindings({ data: model }, reportContainerElement);
-
-        var submitContainerElement = document.createElement("div");
-        $(submitContainerElement).attr("id", "submit-block");
-        $(submitContainerElement).attr("class", "collapse in");
-        $(submitContainerElement).attr("aria-expanded", "true");
-        $(submitContainerElement).attr("data-bind", "template: { name: 'submit-package-template', data: data }");
-        $("#submit-package-container").append(submitContainerElement);
-        ko.applyBindings({ data: model }, submitContainerElement);
-
-        $('#verify-cancel-button').on('click', function () {
-            cancelEdit();
-        });
 
-        $('#verify-submit-button').on('click', function () {
-            $('#verify-cancel-button').attr('disabled', 'disabled');
-            $('#verify-submit-button').attr('disabled', 'disabled');
-            $('#verify-submit-button').attr('value', 'Submitting');
-            $('#verify-submit-button').addClass('.loading');
-            submitEditAsync(navigateToPage);
-        });
-
-        $('#iconurl-field').on('change', function () {
-            $('#icon-preview').attr('src', $('#iconurl-field').val());
-        });
-        
-        window.nuget.configureExpanderHeading("verify-package-form");
-        window.nuget.configureExpanderHeading("submit-package-form");
+        if (model != null) {
+            var reportContainerElement = document.createElement("div");
+            $(reportContainerElement).attr("id", "verify-package-block");
+            $(reportContainerElement).attr("class", "collapse in");
+            $(reportContainerElement).attr("aria-expanded", "true");
+            $(reportContainerElement).attr("data-bind", "template: { name: 'edit-metadata-template', data: data }");
+            $("#verify-package-container").append(reportContainerElement);
+            ko.applyBindings({ data: model }, reportContainerElement);
+
+            var submitContainerElement = document.createElement("div");
+            $(submitContainerElement).attr("id", "submit-block");
+            $(submitContainerElement).attr("class", "collapse in");
+            $(submitContainerElement).attr("aria-expanded", "true");
+            $(submitContainerElement).attr("data-bind", "template: { name: 'submit-package-template', data: data }");
+            $("#submit-package-container").append(submitContainerElement);
+            ko.applyBindings({ data: model }, submitContainerElement);
+
+            $('#verify-cancel-button').on('click', function () {
+                cancelEdit();
+            });
+
+            $('#verify-submit-button').on('click', function () {
+                $('#verify-cancel-button').attr('disabled', 'disabled');
+                $('#verify-submit-button').attr('disabled', 'disabled');
+                $('#verify-submit-button').attr('value', 'Submitting');
+                $('#verify-submit-button').addClass('.loading');
+                submitEditAsync(navigateToPage);
+            });
+
+            $('#iconurl-field').on('change', function () {
+                $('#icon-preview').attr('src', $('#iconurl-field').val());
+            });
+
+            window.nuget.configureExpanderHeading("verify-package-form");
+            window.nuget.configureExpanderHeading("submit-package-form");
+        }
 
         bindReadMeData(model);
     }
diff --git a/src/NuGetGallery/Views/Packages/_EditMetadata.cshtml b/src/NuGetGallery/Views/Packages/_EditMetadata.cshtml
index 37d16bd65d..15e58f2984 100644
--- a/src/NuGetGallery/Views/Packages/_EditMetadata.cshtml
+++ b/src/NuGetGallery/Views/Packages/_EditMetadata.cshtml
@@ -175,7 +175,7 @@
                     </div>
                 </div>
                 <!-- /ko -->
-            </form>
+            @*</form>*@
         </div>
 
         <!-- ko if: $data.IsSemVer2 -->

From 805a5da6368888f1f3b6fe33e2147c2f6541bd38 Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Mon, 25 Sep 2017 11:16:08 -0700
Subject: [PATCH 04/25] Remove WITH (ONLINE = ON) from queries so all SQL
 Servers are happy (#4703)

Fix https://github.com/NuGet/Engineering/issues/781
---
 .../201709111714021_AddPackageStatusKey.cs           | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/NuGetGallery/Migrations/201709111714021_AddPackageStatusKey.cs b/src/NuGetGallery/Migrations/201709111714021_AddPackageStatusKey.cs
index a6f3e510b2..13ef064347 100644
--- a/src/NuGetGallery/Migrations/201709111714021_AddPackageStatusKey.cs
+++ b/src/NuGetGallery/Migrations/201709111714021_AddPackageStatusKey.cs
@@ -28,17 +28,17 @@ WAITFOR DELAY @Delay
 END
 ");
 
-            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_PackageStatusKeyListed' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_PackageStatusKeyListed] ON [dbo].[Packages] ([PackageStatusKey] ASC, [Listed] ASC) INCLUDE ([Description], [FlattenedDependencies], [IsPrerelease], [PackageRegistrationKey], [Tags], [Version]) WITH (ONLINE = ON)");
+            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_PackageStatusKeyListed' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_PackageStatusKeyListed] ON [dbo].[Packages] ([PackageStatusKey] ASC, [Listed] ASC) INCLUDE ([Description], [FlattenedDependencies], [IsPrerelease], [PackageRegistrationKey], [Tags], [Version])");
 
-            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_IsListedPackageStatusKey' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_IsListedPackageStatusKey] ON [dbo].[Packages] ([IsLatest] ASC, [PackageStatusKey] ASC) INCLUDE ([PackageRegistrationKey], [Tags], [Title]) WITH (ONLINE = ON)");
+            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_IsListedPackageStatusKey' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_IsListedPackageStatusKey] ON [dbo].[Packages] ([IsLatest] ASC, [PackageStatusKey] ASC) INCLUDE ([PackageRegistrationKey], [Tags], [Title])");
 
-            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_IsLatestStablePackageStatusKey' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_IsLatestStablePackageStatusKey] ON [dbo].[Packages] ([IsLatestStable] ASC, [PackageStatusKey] ASC) INCLUDE ([Description], [FlattenedAuthors], [Listed], [PackageRegistrationKey], [Published], [Tags]) WITH (ONLINE = ON)");
+            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_IsLatestStablePackageStatusKey' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_IsLatestStablePackageStatusKey] ON [dbo].[Packages] ([IsLatestStable] ASC, [PackageStatusKey] ASC) INCLUDE ([Description], [FlattenedAuthors], [Listed], [PackageRegistrationKey], [Published], [Tags])");
 
-            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_SemVerLevelKeyIsLatestPackageStatusKey' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_SemVerLevelKeyIsLatestPackageStatusKey] ON [dbo].[Packages] ([SemVerLevelKey] ASC, [IsLatest] ASC, [PackageStatusKey] ASC) INCLUDE ([PackageRegistrationKey]) WITH (ONLINE = ON)");
+            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_SemVerLevelKeyIsLatestPackageStatusKey' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_SemVerLevelKeyIsLatestPackageStatusKey] ON [dbo].[Packages] ([SemVerLevelKey] ASC, [IsLatest] ASC, [PackageStatusKey] ASC) INCLUDE ([PackageRegistrationKey])");
 
-            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_SemVerLevelKeyPackageStatusKey' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_SemVerLevelKeyPackageStatusKey] ON [dbo].[Packages] ([SemVerLevelKey] ASC, [PackageStatusKey] ASC) INCLUDE ([IsLatest], [IsLatestSemVer2]) WITH (ONLINE = ON)");
+            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_SemVerLevelKeyPackageStatusKey' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_SemVerLevelKeyPackageStatusKey] ON [dbo].[Packages] ([SemVerLevelKey] ASC, [PackageStatusKey] ASC) INCLUDE ([IsLatest], [IsLatestSemVer2])");
 
-            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_PackageStatusKeyIsPrereleasePackageStatusKey' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_PackageStatusKeyIsPrereleasePackageStatusKey] ON [dbo].[Packages] ([SemVerLevelKey] ASC, [IsPrerelease] ASC, [PackageStatusKey] ASC) INCLUDE ([PackageRegistrationKey], [Description], [Tags]) WITH (ONLINE = ON)");
+            Sql("IF NOT EXISTS(SELECT * FROM sys.indexes WHERE name = 'nci_wi_Packages_PackageStatusKeyIsPrereleasePackageStatusKey' AND object_id = OBJECT_ID('Packages')) CREATE INDEX [nci_wi_Packages_PackageStatusKeyIsPrereleasePackageStatusKey] ON [dbo].[Packages] ([SemVerLevelKey] ASC, [IsPrerelease] ASC, [PackageStatusKey] ASC) INCLUDE ([PackageRegistrationKey], [Description], [Tags])");
         }
         
         public override void Down()

From 6caee6a4191eb7756b63d6211059b1e71019fa0e Mon Sep 17 00:00:00 2001
From: Christy Henriksson <chenriks@microsoft.com>
Date: Mon, 25 Sep 2017 11:20:59 -0700
Subject: [PATCH 05/25] Use 'documentation' wording instead of 'readme' (#4733)

---
 src/NuGetGallery/Strings.Designer.cs                 | 10 +++++-----
 src/NuGetGallery/Strings.resx                        | 10 +++++-----
 src/NuGetGallery/Views/Packages/_EditForm.cshtml     |  2 +-
 src/NuGetGallery/Views/Packages/_ImportReadMe.cshtml | 10 +++++-----
 4 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/src/NuGetGallery/Strings.Designer.cs b/src/NuGetGallery/Strings.Designer.cs
index f7f1310ee6..2e872c21f8 100644
--- a/src/NuGetGallery/Strings.Designer.cs
+++ b/src/NuGetGallery/Strings.Designer.cs
@@ -891,7 +891,7 @@ public static string PreviewReadMe_ConversionFailed {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to There is no ReadMe available to preview..
+        ///   Looks up a localized string similar to There is no Markdown Documentation available to preview..
         /// </summary>
         public static string PreviewReadMe_ReadMeMissing {
             get {
@@ -900,7 +900,7 @@ public static string PreviewReadMe_ReadMeMissing {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to &apos;{0}&apos; is not a valid ReadMe source type..
+        ///   Looks up a localized string similar to &apos;{0}&apos; is not a valid Markdown Documentation source type..
         /// </summary>
         public static string ReadMeInvalidSourceType {
             get {
@@ -909,7 +909,7 @@ public static string ReadMeInvalidSourceType {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to ReadMe file must be less than {0} bytes..
+        ///   Looks up a localized string similar to The Markdown Documentation file must be less than {0} bytes..
         /// </summary>
         public static string ReadMeMaxLengthExceeded {
             get {
@@ -918,7 +918,7 @@ public static string ReadMeMaxLengthExceeded {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to ReadMe file must end with markdown extension &apos;{0}&apos;..
+        ///   Looks up a localized string similar to The Documentation file must end with a Markdown extension &apos;{0}&apos;..
         /// </summary>
         public static string ReadMePostedFileExtensionInvalid {
             get {
@@ -927,7 +927,7 @@ public static string ReadMePostedFileExtensionInvalid {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to ReadMe URL must be a raw markdown file hosted on GitHub..
+        ///   Looks up a localized string similar to The Documentation URL must be a raw Markdown file hosted on GitHub..
         /// </summary>
         public static string ReadMeUrlHostInvalid {
             get {
diff --git a/src/NuGetGallery/Strings.resx b/src/NuGetGallery/Strings.resx
index 17d2732207..92f24a8e5b 100644
--- a/src/NuGetGallery/Strings.resx
+++ b/src/NuGetGallery/Strings.resx
@@ -571,19 +571,19 @@ For more information, please contact '{2}'.</value>
     <value>Conversion of Markdown to HTML failed with '{0}'.</value>
   </data>
   <data name="PreviewReadMe_ReadMeMissing" xml:space="preserve">
-    <value>There is no ReadMe available to preview.</value>
+    <value>There is no Markdown Documentation available to preview.</value>
   </data>
   <data name="ReadMeInvalidSourceType" xml:space="preserve">
-    <value>'{0}' is not a valid ReadMe source type.</value>
+    <value>'{0}' is not a valid Markdown Documentation source type.</value>
   </data>
   <data name="ReadMeMaxLengthExceeded" xml:space="preserve">
-    <value>ReadMe file must be less than {0} bytes.</value>
+    <value>The Markdown Documentation file must be less than {0} bytes.</value>
   </data>
   <data name="ReadMePostedFileExtensionInvalid" xml:space="preserve">
-    <value>ReadMe file must end with markdown extension '{0}'.</value>
+    <value>The Documentation file must end with a Markdown extension '{0}'.</value>
   </data>
   <data name="ReadMeUrlHostInvalid" xml:space="preserve">
-    <value>ReadMe URL must be a raw markdown file hosted on GitHub.</value>
+    <value>The Documentation URL must be a raw Markdown file hosted on GitHub.</value>
   </data>
   <data name="ReservedNamespace_OwnerAdded" xml:space="preserve">
     <value>The user '{0}' is now an owner of the prefix '{1}'.</value>
diff --git a/src/NuGetGallery/Views/Packages/_EditForm.cshtml b/src/NuGetGallery/Views/Packages/_EditForm.cshtml
index 88fbc77543..2b422b7681 100644
--- a/src/NuGetGallery/Views/Packages/_EditForm.cshtml
+++ b/src/NuGetGallery/Views/Packages/_EditForm.cshtml
@@ -21,7 +21,7 @@
             <a href="#" role="button" data-toggle="collapse" data-target="#readme-package-form"
                aria-expanded="false" aria-controls="readme-package-form" id="show-readme-package-form">
                 <i class="ms-Icon ms-Icon--ChevronDown" aria-hidden="true"></i>
-                <span>Import ReadMe</span>
+                <span>Import Documentation</span>
             </a>
         </h2>
     </div>
diff --git a/src/NuGetGallery/Views/Packages/_ImportReadMe.cshtml b/src/NuGetGallery/Views/Packages/_ImportReadMe.cshtml
index 26072e36a5..5f2e6fc662 100644
--- a/src/NuGetGallery/Views/Packages/_ImportReadMe.cshtml
+++ b/src/NuGetGallery/Views/Packages/_ImportReadMe.cshtml
@@ -50,22 +50,22 @@
             <div class="tab-content">
                 @ReadMePanel(
                     @<div class="form-group editable">
-                        <textarea class="form-control" data-bind="value: Edit.ReadMe.SourceText" name="Edit.ReadMe.SourceText" id="ReadMeTextInput" rows="30" placeholder="Write your own ReadMe here..."></textarea>
+                        <textarea class="form-control" data-bind="value: Edit.ReadMe.SourceText" name="Edit.ReadMe.SourceText" id="ReadMeTextInput" rows="30" placeholder="Add Markdown Documentation here..."></textarea>
                     </div>,
                     "readme-written", active: true)
 
                 @ReadMePanel(
                     @<div class="form-group editable">
-                        <input type="url" data-bind="value: Edit.ReadMe.SourceUrl" name="Edit.ReadMe.SourceUrl" class="form-control" id="ReadMeUrlInput" placeholder="https://raw.githubusercontent.com/" />
+                        <input type="url" data-bind="value: Edit.ReadMe.SourceUrl" name="Edit.ReadMe.SourceUrl" class="form-control" id="ReadMeUrlInput" placeholder="https://raw.githubusercontent.com/*.md" />
                         <label id="ReadMeURLLabel" class="input-group-btn"></label>
                     </div>,        
                    "readme-url", active: false)
 
                 @ReadMePanel(
                     @<div class="input-group">
-                        <input type="text" id="ReadMeFileText" class="form-control" value="Browse or Drop files to select a ReadMe.md file..." aria-label="Upload Your ReadMe.md" readonly />
+                        <input type="text" id="ReadMeFileText" class="form-control" value="Browse for a Markdown Documentation file..." aria-label="Upload your Markdown Documentation file" readonly />
                         <label for="ReadMeFileInput" id="ReadMeFileLabel" class="input-group-btn">
-                            <span class="btn btn-primary form-control" aria-label="Browse for ReadMe.md file" role="button">
+                            <span class="btn btn-primary form-control" aria-label="Browse for a Markdown Documentation file" role="button">
                                 Browse&hellip;<input type="file" accept=".md" data-bind="value: Edit.ReadMe.SourceFile" name="Edit.ReadMe.SourceFile" aria-labelledby="ReadMeFileLabel" id="ReadMeFileInput" style="display:none;" />
                             </span>
                         </label>
@@ -82,7 +82,7 @@
 
         <div class="text-center hidden" id="edit-markdown" style="padding-top:3em; padding-bottom:3em">
             <div class="row">
-                <input type="button" value="Edit ReadMe" id="edit-markdown-button" class="btn btn-primary col-xs-10 col-xs-offset-1 col-lg-2 col-lg-offset-5" />
+                <input type="button" value="Edit Documentation" id="edit-markdown-button" class="btn btn-primary col-xs-10 col-xs-offset-1 col-lg-2 col-lg-offset-5" />
             </div>
         </div>
 

From 1151dee5fd86194083333f9db90764c25b69e3ea Mon Sep 17 00:00:00 2001
From: Xavier Decoster <xavierdecoster@users.noreply.github.com>
Date: Mon, 25 Sep 2017 20:45:18 +0200
Subject: [PATCH 06/25] The message stating "A newer prerelease version is
 available" should also be shown when currently displayed version is a
 prerelease (#4732)

---
 src/NuGetGallery/Views/Packages/DisplayPackage.cshtml           | 2 +-
 .../ViewModels/DisplayPackageViewModelFacts.cs                  | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/NuGetGallery/Views/Packages/DisplayPackage.cshtml b/src/NuGetGallery/Views/Packages/DisplayPackage.cshtml
index 3f13ec4a48..e5dd57a8f1 100644
--- a/src/NuGetGallery/Views/Packages/DisplayPackage.cshtml
+++ b/src/NuGetGallery/Views/Packages/DisplayPackage.cshtml
@@ -185,7 +185,7 @@
                 )
             }
 
-            @if (Model.LatestStableVersionSemVer2 && Model.HasNewerPrerelease)
+            @if (Model.HasNewerPrerelease)
             {
                 @ViewHelpers.AlertInfo(
                     @<text>
diff --git a/tests/NuGetGallery.Facts/ViewModels/DisplayPackageViewModelFacts.cs b/tests/NuGetGallery.Facts/ViewModels/DisplayPackageViewModelFacts.cs
index a9da5c3e54..6ea96e00fa 100644
--- a/tests/NuGetGallery.Facts/ViewModels/DisplayPackageViewModelFacts.cs
+++ b/tests/NuGetGallery.Facts/ViewModels/DisplayPackageViewModelFacts.cs
@@ -160,6 +160,7 @@ public void DownloadsPerDayLabelShowsOneWhenAverageBetweenOneAndOnePointFive(int
         [InlineData("1.0.0", "1.0.0-alpha", false)]
         [InlineData("1.0.0", "1.0.0-alpha+metadata", false)]
         [InlineData("1.0.0", "1.0.0-alpha.1", false)]
+        [InlineData("1.0.0-alpha", "1.0.0-alpha.1", true)]
         public void HasNewerPrereleaseReturnsTrueWhenNewerPrereleaseAvailable(
             string currentVersion, 
             string otherVersion, 
@@ -176,6 +177,7 @@ public void HasNewerPrereleaseReturnsTrueWhenNewerPrereleaseAvailable(
             {
                 Dependencies = dependencies,
                 PackageRegistration = packageRegistration,
+                IsPrerelease = NuGetVersion.Parse(currentVersion).IsPrerelease,
                 Version = currentVersion
             };
 

From 0ec72a27fc6e7f4276f46a218da2dc5a4eb7a405 Mon Sep 17 00:00:00 2001
From: Scott Bommarito <scottbom@microsoft.com>
Date: Mon, 25 Sep 2017 13:00:45 -0700
Subject: [PATCH 07/25] Add ownership requests to manage packages page (into
 dev) (#4738)

---
 .../Entities/PackageOwnerRequest.cs           |   5 +-
 .../App_Start/DefaultDependenciesModule.cs    |   5 +
 src/NuGetGallery/App_Start/Routes.cs          |  12 +-
 .../Controllers/AuthenticationController.cs   |   4 +-
 .../Controllers/JsonApiController.cs          |  57 ++--
 .../Controllers/PackagesController.cs         |  93 +++++-
 .../Controllers/UsersController.cs            |  23 +-
 ...ddPackageOwnershipRequestsPage.Designer.cs |  29 ++
 ...2249402_AddPackageOwnershipRequestsPage.cs |  20 ++
 ...49402_AddPackageOwnershipRequestsPage.resx | 126 +++++++
 src/NuGetGallery/NuGetGallery.csproj          |  14 +
 src/NuGetGallery/RouteNames.cs                |   3 +-
 .../Scripts/gallery/page-manage-packages.js   |  17 +-
 .../Services/ConfirmOwnershipResult.cs        |   4 +-
 src/NuGetGallery/Services/IMessageService.cs  |   4 +-
 .../Services/IPackageOwnerRequestService.cs   |  44 +++
 src/NuGetGallery/Services/IPackageService.cs  |  11 -
 src/NuGetGallery/Services/MessageService.cs   |  61 +++-
 .../Services/PackageOwnerRequestService.cs    |  97 ++++++
 src/NuGetGallery/Services/PackageService.cs   |  74 +----
 src/NuGetGallery/UrlExtensions.cs             |  80 ++++-
 .../ViewModels/ManagePackagesViewModel.cs     |   3 +
 .../OwnerRequestsListItemViewModel.cs         |  23 ++
 .../ViewModels/OwnerRequestsListViewModel.cs  |  24 ++
 .../ViewModels/OwnerRequestsViewModel.cs      |  26 ++
 .../Views/Packages/ConfirmOwner.cshtml        | 120 ++++---
 src/NuGetGallery/Views/Users/Packages.cshtml  |  14 +
 .../Views/Users/_OwnerRequestsList.cshtml     |  78 +++++
 .../Controllers/JsonApiControllerFacts.cs     |  70 ++--
 .../Controllers/PackagesControllerFacts.cs    | 314 ++++++++++++++++--
 .../NuGetGallery.Facts.csproj                 |   1 +
 .../Services/MessageServiceFacts.cs           | 108 +++++-
 .../PackageOwnerRequestServiceFacts.cs        | 145 ++++++++
 .../Services/PackageServiceFacts.cs           | 141 ++------
 .../Services/ReflowPackageServiceFacts.cs     |   4 +-
 .../TestUtils/TestServiceUtility.cs           |   4 +-
 36 files changed, 1484 insertions(+), 374 deletions(-)
 create mode 100644 src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.Designer.cs
 create mode 100644 src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.cs
 create mode 100644 src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.resx
 create mode 100644 src/NuGetGallery/Services/IPackageOwnerRequestService.cs
 create mode 100644 src/NuGetGallery/Services/PackageOwnerRequestService.cs
 create mode 100644 src/NuGetGallery/ViewModels/OwnerRequestsListItemViewModel.cs
 create mode 100644 src/NuGetGallery/ViewModels/OwnerRequestsListViewModel.cs
 create mode 100644 src/NuGetGallery/ViewModels/OwnerRequestsViewModel.cs
 create mode 100644 src/NuGetGallery/Views/Users/_OwnerRequestsList.cshtml
 create mode 100644 tests/NuGetGallery.Facts/Services/PackageOwnerRequestServiceFacts.cs

diff --git a/src/NuGetGallery.Core/Entities/PackageOwnerRequest.cs b/src/NuGetGallery.Core/Entities/PackageOwnerRequest.cs
index 23067e4896..7652b9048e 100644
--- a/src/NuGetGallery.Core/Entities/PackageOwnerRequest.cs
+++ b/src/NuGetGallery.Core/Entities/PackageOwnerRequest.cs
@@ -9,9 +9,10 @@ public class PackageOwnerRequest
         : IEntity
     {
         public int PackageRegistrationKey { get; set; }
+        public virtual PackageRegistration PackageRegistration { get; set; }
         public int NewOwnerKey { get; set; }
-        public User NewOwner { get; set; }
-        public User RequestingOwner { get; set; }
+        public virtual User NewOwner { get; set; }
+        public virtual User RequestingOwner { get; set; }
         public int RequestingOwnerKey { get; set; }
         public string ConfirmationCode { get; set; }
         public DateTime RequestDate { get; set; }
diff --git a/src/NuGetGallery/App_Start/DefaultDependenciesModule.cs b/src/NuGetGallery/App_Start/DefaultDependenciesModule.cs
index 0921347fdd..1fa9672f1e 100644
--- a/src/NuGetGallery/App_Start/DefaultDependenciesModule.cs
+++ b/src/NuGetGallery/App_Start/DefaultDependenciesModule.cs
@@ -175,6 +175,11 @@ protected override void Load(ContainerBuilder builder)
                 .AsSelf()
                 .InstancePerLifetimeScope();
 
+            builder.RegisterType<PackageOwnerRequestService>()
+                .AsSelf()
+                .As<IPackageOwnerRequestService>()
+                .InstancePerLifetimeScope();
+
             builder.RegisterType<FormsAuthenticationService>()
                 .As<IFormsAuthenticationService>()
                 .InstancePerLifetimeScope();
diff --git a/src/NuGetGallery/App_Start/Routes.cs b/src/NuGetGallery/App_Start/Routes.cs
index 159ea43c07..feb53963c7 100644
--- a/src/NuGetGallery/App_Start/Routes.cs
+++ b/src/NuGetGallery/App_Start/Routes.cs
@@ -147,7 +147,17 @@ public static void RegisterUIRoutes(RouteCollection routes)
             routes.MapRoute(
                 RouteName.PackageOwnerConfirmation,
                 "packages/{id}/owners/{username}/confirm/{token}",
-                new { controller = "Packages", action = "ConfirmOwner" });
+                new { controller = "Packages", action = "ConfirmPendingOwnershipRequest" });
+
+            routes.MapRoute(
+                RouteName.PackageOwnerRejection,
+                "packages/{id}/owners/{username}/reject/{token}",
+                new { controller = "Packages", action = "RejectPendingOwnershipRequest" });
+
+            routes.MapRoute(
+                RouteName.PackageOwnerCancellation,
+                "packages/{id}/owners/{username}/cancel/{token}",
+                new { controller = "Packages", action = "CancelPendingOwnershipRequest" });
 
             // We need the following two routes (rather than just one) due to Routing's
             // Consecutive Optional Parameter bug. :(
diff --git a/src/NuGetGallery/Controllers/AuthenticationController.cs b/src/NuGetGallery/Controllers/AuthenticationController.cs
index 5c8590e118..84a8cc0796 100644
--- a/src/NuGetGallery/Controllers/AuthenticationController.cs
+++ b/src/NuGetGallery/Controllers/AuthenticationController.cs
@@ -255,9 +255,7 @@ public virtual async Task<ActionResult> Register(LogOnViewModel model, string re
             {
                 _messageService.SendNewAccountEmail(
                     new MailAddress(user.User.UnconfirmedEmailAddress, user.User.Username),
-                    Url.ConfirmationUrl(
-                        "Confirm",
-                        "Users",
+                    Url.ConfirmEmail(
                         user.User.Username,
                         user.User.EmailConfirmationToken,
                         relativeUrl: false));
diff --git a/src/NuGetGallery/Controllers/JsonApiController.cs b/src/NuGetGallery/Controllers/JsonApiController.cs
index 4001cf3528..f5fea3f655 100644
--- a/src/NuGetGallery/Controllers/JsonApiController.cs
+++ b/src/NuGetGallery/Controllers/JsonApiController.cs
@@ -19,7 +19,7 @@ public partial class JsonApiController
         : AppController
     {
         private readonly IMessageService _messageService;
-        private readonly IEntityRepository<PackageOwnerRequest> _packageOwnerRequestRepository;
+        private readonly IPackageOwnerRequestService _packageOwnerRequestService;
         private readonly IPackageService _packageService;
         private readonly IUserService _userService;
         private readonly IAppConfiguration _appConfiguration;
@@ -28,14 +28,14 @@ public partial class JsonApiController
         public JsonApiController(
             IPackageService packageService,
             IUserService userService,
-            IEntityRepository<PackageOwnerRequest> packageOwnerRequestRepository,
+            IPackageOwnerRequestService packageOwnerRequestService,
             IMessageService messageService,
             IAppConfiguration appConfiguration,
             ISecurityPolicyService policyService)
         {
             _packageService = packageService;
             _userService = userService;
-            _packageOwnerRequestRepository = packageOwnerRequestRepository;
+            _packageOwnerRequestService = packageOwnerRequestService;
             _messageService = messageService;
             _appConfiguration = appConfiguration;
             _policyService = policyService;
@@ -64,15 +64,15 @@ public virtual ActionResult GetPackageOwners(string id, string version)
                                  Pending = false
                              };
 
-            var pending = from u in _packageOwnerRequestRepository.GetAll()
-                          where u.PackageRegistrationKey == package.PackageRegistration.Key
-                          select new
-                              {
-                                  Name = u.NewOwner.Username,
-                                  EmailAddress = u.NewOwner.EmailAddress,
-                                  Current = false,
-                                  Pending = true
-                              };
+            var pending = 
+                _packageOwnerRequestService.GetPackageOwnershipRequests(package: package.PackageRegistration)
+                .Select(r => new
+                {
+                    Name = r.NewOwner.Username,
+                    EmailAddress = r.NewOwner.EmailAddress,
+                    Current = false,
+                    Pending = true
+                });
 
             var result = owners.Union(pending).Select(o => new
             {
@@ -113,20 +113,27 @@ public async Task<JsonResult> AddPackageOwner(string id, string username, string
             if (TryGetManagePackageOwnerModel(id, username, out model))
             {
                 var encodedMessage = HttpUtility.HtmlEncode(message);
-                var ownerRequest = await _packageService.CreatePackageOwnerRequestAsync(
+
+                var ownerRequest = await _packageOwnerRequestService.AddPackageOwnershipRequest(
                     model.Package, model.CurrentUser, model.User);
-                var confirmationUrl = Url.ConfirmationUrl(
-                    "ConfirmOwner",
-                    "Packages",
+
+                var confirmationUrl = Url.ConfirmPendingOwnershipRequest(
+                    model.Package.Id,
+                    model.User.Username,
+                    ownerRequest.ConfirmationCode,
+                    relativeUrl: false);
+
+                var rejectionUrl = Url.RejectPendingOwnershipRequest(
+                    model.Package.Id,
                     model.User.Username,
                     ownerRequest.ConfirmationCode,
-                    new { id = model.Package.Id },
                     relativeUrl: false);
+
                 var packageUrl = Url.Package(model.Package.Id, version: null, relativeUrl: false);
                 var policyMessage = GetNoticeOfPoliciesRequiredMessage(model.Package, model.User, model.CurrentUser);
 
                 _messageService.SendPackageOwnerRequest(model.CurrentUser, model.User, model.Package, packageUrl,
-                    confirmationUrl, encodedMessage, policyMessage);
+                    confirmationUrl, rejectionUrl, encodedMessage, policyMessage);
 
                 return Json(new
                 {
@@ -150,9 +157,18 @@ public async Task<JsonResult> RemovePackageOwner(string id, string username)
             ManagePackageOwnerModel model;
             if (TryGetManagePackageOwnerModel(id, username, out model))
             {
+                var request = _packageOwnerRequestService.GetPackageOwnershipRequests(package: model.Package, newOwner: model.User).FirstOrDefault();
+
                 await _packageService.RemovePackageOwnerAsync(model.Package, model.User);
 
-                _messageService.SendPackageOwnerRemovedNotice(model.CurrentUser, model.User, model.Package);
+                if (request == null)
+                {
+                    _messageService.SendPackageOwnerRemovedNotice(model.CurrentUser, model.User, model.Package);
+                }
+                else
+                {
+                    _messageService.SendPackageOwnerRequestCancellationNotice(model.CurrentUser, model.User, model.Package);
+                }
 
                 return Json(new { success = true });
             }
@@ -241,8 +257,7 @@ private IEnumerable<string> GetPropagatingOwners(PackageRegistration package)
 
         private IEnumerable<string> GetPendingPropagatingOwners(PackageRegistration package)
         {
-            return _packageOwnerRequestRepository.GetAll()
-                .Where(po => po.PackageRegistrationKey == package.Key)
+            return _packageOwnerRequestService.GetPackageOwnershipRequests(package: package)
                 .Select(po => po.NewOwner)
                 .Where(RequireSecurePushForCoOwnersPolicy.IsSubscribed)
                 .Select(po => po.Username);
diff --git a/src/NuGetGallery/Controllers/PackagesController.cs b/src/NuGetGallery/Controllers/PackagesController.cs
index f1a6807564..f0228b507b 100644
--- a/src/NuGetGallery/Controllers/PackagesController.cs
+++ b/src/NuGetGallery/Controllers/PackagesController.cs
@@ -44,9 +44,11 @@ public partial class PackagesController
         private readonly IAppConfiguration _config;
         private readonly IMessageService _messageService;
         private readonly IPackageService _packageService;
+        private readonly IPackageOwnerRequestService _packageOwnerRequestService;
         private readonly IPackageFileService _packageFileService;
         private readonly ISearchService _searchService;
         private readonly IUploadFileService _uploadFileService;
+        private readonly IUserService _userService;
         private readonly IEntitiesContext _entitiesContext;
         private readonly IIndexingService _indexingService;
         private readonly ICacheService _cacheService;
@@ -62,7 +64,9 @@ public partial class PackagesController
 
         public PackagesController(
             IPackageService packageService,
+            IPackageOwnerRequestService packageOwnerRequestService,
             IUploadFileService uploadFileService,
+            IUserService userService,
             IMessageService messageService,
             ISearchService searchService,
             IAutomaticallyCuratePackageCommand autoCuratedPackageCmd,
@@ -82,7 +86,9 @@ public PackagesController(
             IReadMeService readMeService)
         {
             _packageService = packageService;
+            _packageOwnerRequestService = packageOwnerRequestService;
             _uploadFileService = uploadFileService;
+            _userService = userService;
             _messageService = messageService;
             _searchService = searchService;
             _autoCuratedPackageCmd = autoCuratedPackageCmd;
@@ -1114,18 +1120,32 @@ public virtual async Task<JsonResult> Edit(string id, string version, VerifyPack
             });
         }
 
+        [HttpGet]
         [Authorize]
         [RequiresAccountConfirmation("accept ownership of a package")]
-        public virtual async Task<ActionResult> ConfirmOwner(string id, string username, string token)
+        public virtual Task<ActionResult> ConfirmPendingOwnershipRequest(string id, string username, string token)
+        {
+            return HandleOwnershipRequest(id, username, token, accept: true);
+        }
+
+        [HttpGet]
+        [Authorize]
+        [RequiresAccountConfirmation("reject ownership of a package")]
+        public virtual Task<ActionResult> RejectPendingOwnershipRequest(string id, string username, string token)
         {
-            if (String.IsNullOrEmpty(token))
+            return HandleOwnershipRequest(id, username, token, accept: false);
+        }
+
+        private async Task<ActionResult> HandleOwnershipRequest(string id, string username, string token, bool accept)
+        {
+            if (string.IsNullOrEmpty(token))
             {
                 return HttpNotFound();
             }
 
-            if (!String.Equals(username, User.Identity.Name, StringComparison.OrdinalIgnoreCase))
+            if (!string.Equals(username, User.Identity.Name, StringComparison.OrdinalIgnoreCase))
             {
-                return View(new PackageOwnerConfirmationModel(id, username, ConfirmOwnershipResult.NotYourRequest));
+                return View("ConfirmOwner", new PackageOwnerConfirmationModel(id, username, ConfirmOwnershipResult.NotYourRequest));
             }
 
             var package = _packageService.FindPackageRegistrationById(id);
@@ -1137,21 +1157,72 @@ public virtual async Task<ActionResult> ConfirmOwner(string id, string username,
             var user = GetCurrentUser();
             if (package.IsOwner(user))
             {
-                return View(new PackageOwnerConfirmationModel(id, username, ConfirmOwnershipResult.AlreadyOwner));
+                return View("ConfirmOwner", new PackageOwnerConfirmationModel(id, username, ConfirmOwnershipResult.AlreadyOwner));
+            }
+
+            var request = _packageOwnerRequestService.GetPackageOwnershipRequest(package, user, token);
+            if (request == null)
+            {
+                return View("ConfirmOwner", new PackageOwnerConfirmationModel(id, username, ConfirmOwnershipResult.Failure));
+            }
+
+            if (accept)
+            {
+                var result = await HandleSecurePushPropagation(package, user);
+
+                await _packageService.AddPackageOwnerAsync(package, user);
+
+                SendAddPackageOwnerNotification(package, user, result.Item1, result.Item2);
+
+                return View("ConfirmOwner", new PackageOwnerConfirmationModel(id, username, ConfirmOwnershipResult.Success));
+            }
+            else
+            {
+                var requestingUser = request.RequestingOwner;
+
+                await _packageService.RemovePackageOwnerAsync(package, user);
+
+                _messageService.SendPackageOwnerRequestRejectionNotice(requestingUser, user, package);
+
+                return View("ConfirmOwner", new PackageOwnerConfirmationModel(id, username, ConfirmOwnershipResult.Rejected));
             }
+        }
 
-            if (!_packageService.IsValidPackageOwnerRequest(package, user, token))
+        [HttpGet]
+        [Authorize]
+        [RequiresAccountConfirmation("cancel pending ownership request")]
+        public virtual async Task<ActionResult> CancelPendingOwnershipRequest(string id, string requestingUsername, string pendingUsername)
+        {
+            if (!string.Equals(requestingUsername, User.Identity.Name, StringComparison.OrdinalIgnoreCase))
             {
-                return View(new PackageOwnerConfirmationModel(id, username, ConfirmOwnershipResult.Failure));
+                return View("ConfirmOwner", new PackageOwnerConfirmationModel(id, requestingUsername, ConfirmOwnershipResult.NotYourRequest));
             }
 
-            var result = await HandleSecurePushPropagation(package, user);
+            var package = _packageService.FindPackageRegistrationById(id);
+            if (package == null)
+            {
+                return HttpNotFound();
+            }
+
+            var requestingUser = GetCurrentUser();
+
+            var pendingUser = _userService.FindByUsername(pendingUsername);
+            if (pendingUser == null)
+            {
+                return HttpNotFound();
+            }
+
+            var request = _packageOwnerRequestService.GetPackageOwnershipRequests(package, requestingUser, pendingUser).FirstOrDefault();
+            if (request == null)
+            {
+                return HttpNotFound();
+            }
 
-            await _packageService.AddPackageOwnerAsync(package, user);
+            await _packageOwnerRequestService.DeletePackageOwnershipRequest(request);
 
-            SendAddPackageOwnerNotification(package, user, result.Item1, result.Item2);
+            _messageService.SendPackageOwnerRequestCancellationNotice(requestingUser, pendingUser, package);
 
-            return View(new PackageOwnerConfirmationModel(id, username, ConfirmOwnershipResult.Success));
+            return View("ConfirmOwner", new PackageOwnerConfirmationModel(id, pendingUsername, ConfirmOwnershipResult.Cancelled));
         }
 
         /// <summary>
diff --git a/src/NuGetGallery/Controllers/UsersController.cs b/src/NuGetGallery/Controllers/UsersController.cs
index cf6431c7d5..83b06d6976 100644
--- a/src/NuGetGallery/Controllers/UsersController.cs
+++ b/src/NuGetGallery/Controllers/UsersController.cs
@@ -21,6 +21,7 @@ public partial class UsersController
         private readonly IUserService _userService;
         private readonly IMessageService _messageService;
         private readonly IPackageService _packageService;
+        private readonly IPackageOwnerRequestService _packageOwnerRequestService;
         private readonly IAppConfiguration _config;
         private readonly AuthenticationService _authService;
         private readonly ICredentialBuilder _credentialBuilder;
@@ -29,6 +30,7 @@ public UsersController(
             ICuratedFeedService feedsQuery,
             IUserService userService,
             IPackageService packageService,
+            IPackageOwnerRequestService packageOwnerRequestService,
             IMessageService messageService,
             IAppConfiguration config,
             AuthenticationService authService,
@@ -37,6 +39,7 @@ public UsersController(
             _curatedFeedService = feedsQuery ?? throw new ArgumentNullException(nameof(feedsQuery));
             _userService = userService ?? throw new ArgumentNullException(nameof(userService));
             _packageService = packageService ?? throw new ArgumentNullException(nameof(packageService));
+            _packageOwnerRequestService = packageOwnerRequestService ?? throw new ArgumentNullException(nameof(packageOwnerRequestService));
             _messageService = messageService ?? throw new ArgumentNullException(nameof(messageService));
             _config = config ?? throw new ArgumentNullException(nameof(config));
             _authService = authService ?? throw new ArgumentNullException(nameof(authService));
@@ -58,8 +61,7 @@ public virtual ActionResult ConfirmationRequired()
         public virtual ActionResult ConfirmationRequiredPost()
         {
             User user = GetCurrentUser();
-            var confirmationUrl = Url.ConfirmationUrl(
-                "Confirm", "Users", user.Username, user.EmailConfirmationToken, relativeUrl: false);
+            var confirmationUrl = Url.ConfirmEmail(user.Username, user.EmailConfirmationToken, relativeUrl: false);
 
             var alreadyConfirmed = user.UnconfirmedEmailAddress == null;
 
@@ -155,9 +157,15 @@ public virtual ActionResult Packages()
             var packages = _packageService.FindPackagesByOwner(user, includeUnlisted: true)
                 .Select(p => new ListPackageItemViewModel(p)).OrderBy(p => p.Id).ToList();
 
+            var incoming = _packageOwnerRequestService.GetPackageOwnershipRequests(newOwner: user);
+            var outgoing = _packageOwnerRequestService.GetPackageOwnershipRequests(requestingOwner: user);
+
+            var ownerRequests = new OwnerRequestsViewModel(incoming, outgoing, user, _packageService);
+
             var model = new ManagePackagesViewModel
             {
-                Packages = packages
+                Packages = packages,
+                OwnerRequests = ownerRequests
             };
             return View(model);
         }
@@ -389,8 +397,7 @@ public virtual async Task<ActionResult> ChangeEmail(AccountViewModel model)
 
             if (user.Confirmed)
             {
-                var confirmationUrl = Url.ConfirmationUrl(
-                    "Confirm", "Users", user.Username, user.EmailConfirmationToken, relativeUrl: false);
+                var confirmationUrl = Url.ConfirmEmail(user.Username, user.EmailConfirmationToken, relativeUrl: false);
                 _messageService.SendEmailChangeConfirmationNotice(new MailAddress(user.UnconfirmedEmailAddress, user.Username), confirmationUrl);
 
                 TempData["Message"] = Strings.EmailUpdated_ConfirmationRequired;
@@ -751,12 +758,10 @@ private static int CountLoginCredentials(User user)
 
         private ActionResult SendPasswordResetEmail(User user, bool forgotPassword)
         {
-            var resetPasswordUrl = Url.ConfirmationUrl(
-                "ResetPassword",
-                "Users",
+            var resetPasswordUrl = Url.ResetEmailOrPassword(
                 user.Username,
                 user.PasswordResetToken,
-                new { forgot = forgotPassword },
+                forgotPassword,
                 relativeUrl: false);
             _messageService.SendPasswordResetInstructions(user, resetPasswordUrl, forgotPassword);
 
diff --git a/src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.Designer.cs b/src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.Designer.cs
new file mode 100644
index 0000000000..5bd5129d5f
--- /dev/null
+++ b/src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.Designer.cs
@@ -0,0 +1,29 @@
+// <auto-generated />
+namespace NuGetGallery.Migrations
+{
+    using System.CodeDom.Compiler;
+    using System.Data.Entity.Migrations;
+    using System.Data.Entity.Migrations.Infrastructure;
+    using System.Resources;
+    
+    [GeneratedCode("EntityFramework.Migrations", "6.1.3-40302")]
+    public sealed partial class AddPackageOwnershipRequestsPage : IMigrationMetadata
+    {
+        private readonly ResourceManager Resources = new ResourceManager(typeof(AddPackageOwnershipRequestsPage));
+        
+        string IMigrationMetadata.Id
+        {
+            get { return "201709202249402_AddPackageOwnershipRequestsPage"; }
+        }
+        
+        string IMigrationMetadata.Source
+        {
+            get { return null; }
+        }
+        
+        string IMigrationMetadata.Target
+        {
+            get { return Resources.GetString("Target"); }
+        }
+    }
+}
diff --git a/src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.cs b/src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.cs
new file mode 100644
index 0000000000..b01a54aa10
--- /dev/null
+++ b/src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.cs
@@ -0,0 +1,20 @@
+namespace NuGetGallery.Migrations
+{
+    using System;
+    using System.Data.Entity.Migrations;
+    
+    public partial class AddPackageOwnershipRequestsPage : DbMigration
+    {
+        public override void Up()
+        {
+            CreateIndex("dbo.PackageOwnerRequests", "PackageRegistrationKey");
+            AddForeignKey("dbo.PackageOwnerRequests", "PackageRegistrationKey", "dbo.PackageRegistrations", "Key", cascadeDelete: true);
+        }
+        
+        public override void Down()
+        {
+            DropForeignKey("dbo.PackageOwnerRequests", "PackageRegistrationKey", "dbo.PackageRegistrations");
+            DropIndex("dbo.PackageOwnerRequests", new[] { "PackageRegistrationKey" });
+        }
+    }
+}
diff --git a/src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.resx b/src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.resx
new file mode 100644
index 0000000000..5583429cf0
--- /dev/null
+++ b/src/NuGetGallery/Migrations/201709202249402_AddPackageOwnershipRequestsPage.resx
@@ -0,0 +1,126 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <data name="Target" xml:space="preserve">
+    <value>H4sIAAAAAAAEAO1dbW/cOJL+fsD9h0Z/ulvMuuPM7GA3sHfhcZIZ4+IkSCeD+2bILdrWjlrqkdSJvYf7ZffhftL9haNemy9VfJGoN28jQOAWySJZLBbJYtXD//uf/z372+M2XHwlSRrE0fny9OTFckGiTewH0f35cp/d/fHPy7/99V//5eyNv31c/Frn+z7PR0tG6fnyIct2r1ardPNAtl56sg02SZzGd9nJJt6uPD9evXzx4i+r09MVoSSWlNZicfZpH2XBlhQ/6M/LONqQXbb3wuvYJ2Fafacp64Lq4r23JenO25Dz5fv9zyT72QtDkjwtFxdh4NE2rEl4t1x4URRnXkZb+OpLStZZEkf36x394IWfn3aE5rvzwpRULX91yG7aiRcv806sDgVrUpt9msVbS4Kn31dcWYnFW/F22XCN8u0N5W/2lPe64N358jIhPolyViwXYnWvLsMkz8oz9+RQ5LsFnxAn5LtGGKjM5P++W1zuw2yfkPOI7LMkL/RxfxsGm/8gT5/j30h0Hu3DkG0kbSZN4z7QTx+TeEeS7OkTuauaTjMtFyu+4Eos2ZRjC5Wduoqy718uaRfC0LsNSSMFDAPWGe3SzyQiiZcR/6OXZSShg3hV9D+Tqxcqo9KWGFSoJpKXrSlQ2aUTcLm49h7fkeg+ezhf/vjDcvE2eCR+/aEi+iUK6HSlZbJkT6wr/dUL96paX/7pxz6qfU3STRLsSlnvXLm6rsMg9lwRnS+59NT1vKY/PlMl10ryLuPtbl8QU9f55nEXJCSV6zQoVjTgc7D5LWUENxczddl3XppRgQf6KZR7730N7otKBArrDf1JK/1EwiI5fQh2pQ4/KZJuWGX1Nom3n+KwLsak3Xz2knuS0XbESIZ1vE82Fg3L5zHYLIZmmefQKiGpqbNulJheN5pt09nqoK+VWrzoobECL3Ifdbd21lbj01mDr/e3fyebTKFo6J8OFM1FGMbfiH+x0ehP09p03UTnCztPu05mcd6gs73VxClnreG8yTMfp41mBdl6QXjh+3TxSXtfWb/QE0l0FyRb4g9bLxWEyNsOvy0re1lO87ryn2I6L7zImtb7OAvunj56m9+8e/Jxnz50J1k077IcknIXkUu7gku5MHYejY9emn6LE/8TSUk2Uo2HjVO+7bHddlU7xC/ZxrZkvul6S5lO+xPfB1ELCkzpy5gevy2XOoM1AN7RWWydxP0ctrUybdo11RFU5uF2FRQPOQ6t4hKkZYlPhdYkVYtyQUq+Er+xZ8Btk7LdfPhGFTXXTCyPxEU0oy07c3IKXlbJAiOLrzAXyyRbFq7JZp/QBepjTBfaQNEgLuOTJHxIFol9WD6Ie8bbkUKBVlJkvC1hCx23J2pt91Psqw78bvbhuTDBph/NOYEc1G/bJXios8bnuJ1xC52/NdPAecuK+M0h52HWghkk9QLnstU0Zde7LB6QLpGXllYaRNLqxmpEKnnUJd1spKcv/9zHGeAqXT94CTfC3VTGVfoxIXfBozUddIbUuxLXWxhxPmv3OqYNrk5Bn8h9kGblPt60+XBRVWegEgZdA4t1Mn4AFI21BVD2qC90Fw7DK4vX8bcojD2/zdFOUhN0LIO7oIWZoI2iAAQMUBV4LmlGKbK2VBfmDT8UUDe9zmfU+CbzYKdNR7pOfxJVqsguus5Wvx11ms4SJg1U5+uSy3j3lAT3D/0fYsa4mTW74nbTPzqpiZeS93FGVEZxN5U5XGrePOY89cJKur4kYe+t/8VLHy7C+zgJsoetap1+4aiy4Z0rrjZxNAQrr9J3dGaknU0ZNZ11lhdyRo1sqf5+6bZxjogWLhQ7f3CdlNf7xg/AajUlgw2J0mFmaOCTqrpPZBcnneXrnRfd74s9AT4TXcz2YjPAXq8NMqaV7nwbUOkM/kEYhZxfTVqyiv7MrYpDDHM+tmlA+/40kNr/RDz/mlC+FEuOJFS61v6+zx2tKsG82OT+ql7U3Siz3m+3XtK/rfqzd9//1uBzkIXKaebkVr7alg9+Kf8+TrZeSOeY76wFunuCfLV5R74SwDfJSF8XJ63eh53T1kPM5nf0ENLdi6Gwhybl1rkrrbdhrrcj4l/ss4c46Z/nTYWvyY5E9BRX3oUOVWu16hRu9b3Xeh1El2FAD6r6efeDi3nX5k7vNZUjBzJZ8ZXuNrN9yrSBtTiViR2scY2M4latmyaPZMiqkzDbVZNua67iJVnRNj6j3EA2HW0ll8m2qZzGUzaWy3nTWKekRoP5JAuaMrOtP0dVLj8QKLuQZ1C0nE3GGszladnOX6jSp8d2tWyUmZ4UzRVyYC0Ws7VsNH/n0pcVGemD2uRs2ZNK1SumJZ9RnpZsOjotuUzWvkH7XT4jiP82ob+/xclvyhY3uRTiIuXBmC1ndBZ9UBMUnSHY7yhDuwcdVJRKtW5rWC9LHc3rRst+Z5P6e7WzcsvtmE41dN1IIDNK2mh0kd5muX+yleBDyaMUDyPFTi7QjWwI6x3Z9G6vKMW7WR/c19dpflptprGZCu64u0xXwQBsN2O5wsdJO8ykVcU22NpEye97wthW2zXIxBzV0w3cZbzdMj6+A8z0SuQtjqKHEpqzaJ0R22EiuVv62vR3ljZqvrjJd6DDWmqvo97qtNV15WencK6ytP3YTzgj6480PbuIbG6nsZXXvMxRWIdZZN0AjdA1Oc287a7zQv05CYgLP6DCLyFJcutC77fO+SVwbkGXboJnfis61MXTcF57Q3rQDeUzNaAfzbP15RjU2/Ho+OHc5GBzn4Rs2sE7J1d29oI4Ymtv0pQtc2Zzr26hbLdkVbHjrmzMXdlgm7Dj9uK4vThuL47bi2e0vegnjmJCkSFOvbbtwgncObE73BPa++0g+y/MvcfV5rCmj+wP2WRdE53tEvMvtlvEPOW4P5yzV4a1V/wY3h9WPmHY7TLoONZlwjB38Xazpil4nDoz9nlo5/eHaHPcQbCVhOa0zaF8aOajJE7KJS5f1FuC5IFoUTx+XiuRkhHsrJBw+aJHcRvghk4jsz15raz3ty5R+R2/RNDHRHWNHQnBXKowJltN58t9IZlvSX5GM33K41DmOIEntV5cexHdMyBLBjNsN4eMDIAukC4/QABlcoqExNYAxa5A6cpmSoEtXSZKs8ezmytVseN00djrD8PWedkDwpY607zY52OeBRs6gE9VYzsHDkebcO87QWbvw8SMQ3WzK4ereSyBdqsmu+voOX6uQnBiQPsVuTGtpCrSSUdVemVNsqwYfUMdxRc76ijNPCOPGYgo42jO2ZqfCjTC/OanAE+ys0CxZY/jPvx68p58K4agM6FqDKn8uaHHPsdxSQV1kKtL2gH4HYzWd0U1f1X2O3YO3BwKSDY8MB9mx4MzOwAYNu6JZvUyLGLUP9N1TNVVQYCNuymVU3dRyG7UPbGMi0u2EuDDPng0L3VU1DpXnAI85UNkr0hgSj89OdDPXjrI62qiFS64j7xcDgaoWgHFUrFRNavLTDdMXmkmi1mw2Svl6wOpuaoEOtnAOTStbWml2G9l5VJD+lylb0Pv/vBQsZ2yKak4VDZUnnyShE9U/tipxI/JNdnekqQ+bn/1grCE8SwMuufLF9IgcgUa3KQq+6nMxpJh7MeLNI03QcGRetaITw3yVb6J/IXu3cGnBmepemXzmrIo2OWvDGVP58s/SP1QEG0OxQei7DOIPOXTpajDP0QlWxblE490c+elG8+XJzDljs9/oWqfJGU9dEeYL+5BlMlrRBBtgp0XatovlDNdXfKGNVWIKXWoeKYZEJO6hbc75VY0lQls03HpbMWImFry4CdrMEnRvF9zEBf+hShzUVQ/fcNUUN5p8IRfnJycSrRbSZSyGUOIlZLRJg3gHncaRbL4R4awAUeeq1MPtFOVg7UFEDo7qW4leSA/hpA4sPMmFTNPbI0iZ+hTPdgw69/tOYw48E6VuTLTv3GoFvM/iJsJY55AB2QNV/AiEF/Aw745ZxSVDcWbBtlJ00YZL1LiwkDqSWwQwKkqS4111ouGQvgyhI5COGBSNesMO4qagrCGtLIHQ4GOLYAwppLUKhazrFdJhLg0pDhC/JiTTCJAHxox0MHsSPIg3GFZrxY6mBGsQudLBwzkY9V6ySu3Z26Jzr0D65Au01vZkQGnuXIA5zTduQB2jRTB0eyS8JTAO9YyCmMvz0c0ofYPKJHQ4MxOEJX2JjFjTyJoY2RyZGHCqh9afGztSuOe9YUQREMlhsZeSkLUAFZYyxGKyz4fbYZ0YUCJRAZqTjqNC7A1lBmNZusulOMY0RWNGEGmZqno+ABU3bmczTwdawHXKlwtllHgvdoJIP4MaSeAODEn3SYHnmrGXhGFKo0/E2xrrecUr1xopV/Wdy2mqYm216n5Fv0eV7GPpdHnqcrhJ3I0A6x5dd3qPqZfNa952aeFtHcRTSXfBhRVJVcsVL/kAz6Rm1ageTb3rlDxAW5hwWpxUbW45LR1jyjj6bGWAxH0dreiGDWgryVwg8vOQUHIqrYpI5L5botwAHZMUIU0D+l40to/RNGBIXSbZrCmvyIz3npKqRTyQdKIu0WqpFAkPBvpQxo+hNQhgzEDaYOi4FHJUIbEM3LHxsJaCJ4qmL43jxuDMFdNgxVFFdxpcbCyCJgdcffdbu4ad22Q6Ww8sLPbJoNx6CYzUnXAU0z4ng526nD59pOti/CCbBpQXEFmmNQv4kyMaYmA408153tNMKqkC/kgcWvLljqcdfL7JJNeDGiGUA6eSTu4sPHJyK7NRsKw/EAS/Zz2FZb9G0vsn9MOA+qfGJduI45okHqvkwALc5+ldkc6M5a0IyNq0hwI2WNMKZfitDUyhgdtAx7qJSiCtRyjAd9zkV2sAwPKKzZOJk3gcRImIJ2mF3poiL6hbIKXuNpaWl/Dofwo0QEoDzPKwSYavvgakDT/Th4hcCg6KSoMgLRCeRC7ktNdk0wy1abLxQGSALC+SjzhCRVx2hCNKlpeU7zCRZZKl5NcU5gNG4WI8GGlGmLSdRZEEbgw05AFb/JkwuCO1Iy0gpwpieYVJ4xQHfhmRo5/Ox6jyYYxmdHlIgUUlIUQDyvierKmBHM3YAW10q/ajFTpa6fkZuPMaEaxdHxDqZVOY2akGichBT3GCUk3DYubW2DmFfeoBtqEu0GDWQZddWooM3YmUGGyVkQzUorZK1r+NAR51EeIoAgnaTaw7MZXMbb80cVUQ+QLqVI5lKu0QI5ZNYUliAV5WTDZ2NUIBYLh1noUCqbpy2HVk3ZIBuAvDBluFRb3pXxfDfgAQ44AzDDAJuG6okYnYfojLMgK7qjxSBiS1QahM3N41AyAKQpYDa7lMLCGrsUKEkCnlXxs0XkUygHggxnsA9cfLfAD0zVom6VglRbqoQdRgSxaOL8UufFu4YUgnsF7SAXXFOT751sDAIEzC8aIgLogoUTIbDFihQTuINNpmu2MEfw+GOcGDl0AdgUEL2jLFxBzQCbGd8UVh5AAeZxVJhH1UDc1MfVyf8Wjhp6Tmih6tIre2NlsHw25Wee37GktSP3xsq4BZ6VDHvKvkKOsw2O9of6A0d5yN6oTo54/YHx3/2zB9pNSHrMOYLvIVtzoe//IH7MNJEQZSwt1A4umlTnDmAP03MECaHsVF/45VC2PzIQGDOt0xJ2BxEd4+BLfEnD59Ks4m73zloAjhotL1QdXrAFeX0TZowmYg3qFh8zJPWMtWnp+4UFyvU4x3dwynFS62WQmMgNNHzjWy/BQ1uS3Ozc1lz19HcyaCvoVG8MgIyOLAFjS5hAPEejFWgBWhDNaOZJtrU6VSRsxOQGhSrKxiA9Wsjc28eFJLIPLtjnpKPg6ItxrbQyT1AVVFJPAD/kGQMMeVeBSD8pMDJMBeKSMpOHaj8XSmFmZlaT6ZAH4giHAB22MB98DVZQHyxHuNkfFElVcR398EXZi/K0wyiVVKW0XFYUVHDTaJFjEfvSvkeHH7NSSZ7BzUIYbdJU81Q5BMxDt91rIa0roXsvA+x3aCqn932V5EC4l9Xsttcd7f3tV/RtOZqy0m82GFHpj8LiTG2qR9K6UGduVbr9aNmCOv67Zjbn69ifW8us+KD/VDqZQ31AXU+hCovIg0HMMdSrtnUsGR1Sln6OiNwbHUnsWOT6K1o8dNe6MTdrZar15IFuv+nC2olk2ZJftvfA69kmY1gnX3m6XO7UcSlZfFuv8fEfXvz+ul4vHbRil58uHLNu9Wq3SgnR6sg02SZzGd9nJJt6uPD9evXzx4i+r09PVtqSx2nD8Fp0vm5qyOMnNzHxq/rSiT94GSfHWoXfr5Z5hl/5WyiY6byIOMnVtsn+mPHq1z0xdJv+7Ciji3nhC3V0OfHxLu7bNfYiLt9rAU4NcmBZfb7zQS6DX4S7jcL+NFC7NePkmoJylgUaZ43RK9zWWCOTQpqJQPDvFk6g+mdN4TdJNEuzKxZ6lxCWY0zs8m8cSwx7TU1GiY1s+eM0Saj6a03nzuAuSXCWwdJqPlnQKBfI52PwG0WMTzem+89KMio/Q0cNXmdLZSpgX4uRbSbNP0IbihDaa7pU/WeuZXjpb209ypFxf81t4mEuQPtWbXTjN9f7272ST8dSaj+Z0LsIw/kb8MlyEpyYkTUZqyk1La6GBLEsGMgMX60tkCle4C9+nGkXUC1yKxSITbco3kYmPE0cz2S1mkbcl8mpWfrXlQSmEEA/qFHOK7+MsuHuqtnQf9+mDSBjMYNli9unp4vVIoO1AHvNaPnpp+i1O/NzsnwE1QOldqB9WovJ1a3VdYm7r5flLtgFX6OK73SL4lrKa+O/i+yCSqELp5tSZkpfxPhL0sJw6GeXJ+9i2VqJcjJG9MlUX70up/hT7AoHyi8Wws88gciOueh8Rp7cmouiUX4bfBzDP7nEHCPw1vtFEGLgdbS3HcmSbvTAb0OhLol2c167S9YOXcMF93EFLTrah/TEhd8GjSLL+OhmZMrzaN5QqA+O1gVwZUelLsq588bxtZQOIv0Vh7PnA2igk2cjSryQJ7gJxz8Z+n5o8dZeh9nIznKwAgiqRxPJYbA/j3VMS3D8I8sR8Ht4S5NrW9YmExEsJPYaI5iU+ZdyZ+OYxy09zYTWmX5JQNF3J6ebUf/HSh4vwPk6C7GHLExaS7GjKpKy0Dz0YSx1tPtposXdUyNJM1GH1V3tK68y7DaVFm09rQZVsqVp9iZCtE9u2Vk2dz2Jp99z58szmEuzo5V72ELn6uwW1MrpDEiL2u4VEB74Y8M+Jt5xs0+/ofl+4IvO9rr9arAz72zCQzSzMZ+tV5i09Wq+Df0h2CCHRgm4S54claVzY7zYafBenQe5cLxEUkqy01yfi+dfkKioVq6TKymS7dv6+z+8rKiG52OT3kF4k7v4V2WzOqNutlwgbguajxRnVuxdWxfKLBYUgE1Vl9cnizEWSVFrvm482xshk64VUWH2QIpBsY1fIlec78pXIVw5imrUGK06CoA6rUqwplioK04xMqg3lVNbb1TfL82tSbr2AM2yTYmFBCr0sIxHxm7hbzowkpbagzAetguRVca1GdfDBMGAdqngZVR3XQXQZBvRgA04LOXX4e/bKpUbc8VcfrVc0ut/J9il2YmJSp3a6xcPZ7c64FcxS65MuVr7n8y42YpbU8v8F1e/BF2XjjrYmXN9uyBkUrNbDrqIxj6HvZmSrNOB6RzbgZqRMsNle5d5vDGYVv9MSEqcmnkK4fVcB5Q9PrWVUQ2YeYur2YnadO+9KB43DV7uzFrBtbLVfvIy3W+kyrvk4UWF3JuadBXw40Z7LclniOHQdnwIusfXgwKXnoXScOcUG9EyaedudeOxvPlvQSgICWdLZ75bmxSTJAUYl62L52UYV5gag/KyAGImYDEMbTMCTbosDrssLIOdOyo6uB9waiadv2nR/4fW8DZvjrmkHjJmu61qN29t6aUMJHFe31qvbUdcb0Tvq+qOuH/MSq7szQx8uFn1dz7q+1G9zJT3uqouhodmtuEUoYOvlFi49j7XW3GLg6sp3XHlhcNy6Cs3B3ttachQk+hKfmRqyMUgsU1f2/KkI+2GCi/3TWu9AJK3WYwI8uWE/QiZE+hovV+eU7jp4vb9FtvF8Sj/BEyNJI4eb1FoK2Wda7MVPWfqfVk+IAFRdB6e9u7+OQF9DJL5BzZ3TNe9T41SHiSW42OfvyGUBTQufqsZKNgsgh4WRINqEe1+KVWm+2vgJSudl9KA80mQQn2JqPRmEF5vsJ4OOQG/6ijxmCndsIHkygwcicnU9OHCvY7U+O6ip9Hz67FkFcW+g87KieBwdpwe9sysawXTv8OLUWcCCHABKNMuKqdbtlqEFuISpzZYaZKzrPKkefGs9Q7Dyfc2Nysv1g2RJbz5b06pe3QXIIe/xqmTJS8XTQf3N4qQR3Edetk9ED6XD5+GlkQeb08TDN892mQa9NwW0oe0YLLM0EOqn0WT+mUmrRBd5sJlpUYfGoo9YmzUWPSbj7RNRBa1lAQIi1UiDqohBSLqhROC1dJUJ06XYUioUDZ6vXGAvj1n4wjKlTHxe1W6CON/VT5e11x85OYfioX7+rG0zKzojCQnwJI3hLcGhgO1lAM5h9J2ZjvrixqEUoK/stG2jfdvoFtwP8lFdXKXv92F4vrzzQjFoTdH1zsJj+tCK8Z4ELq7doRigphjtAaDqZ7J9AZvuZtZ0WGU7Sxj7qozivqXOAl2jQJddAEvlx2cGXOt1Leo4kDmRoUcOfvdEf1vBZFbcShjuQFWvpLRlps7ObTnKqndXZrjblODgTWwhTHZDYCN8XUZA4zvqwIqqw/0DgkM/zd0D3n293EjQ+GKWxo5SfWl+N9D4FSw9h5dfcCZHv180iyCAU19mWS4oE74Gfo5Rv35KM7I9yTOcrH8Py8DyQwY6BYM7kpa4pufLly9OXy4XF2HgpeVjBhUC/6vNPs0vi6IozqqnDgwg+U+/zyH5ib9dicXtgf1zKmnqc5D1jCmy1i4ItP0ZHUpRIGpB+UTuFqhQna3EkmeQaOZNOF8GOWeLGf0zoQNfXllmeagKC+aeC1+O/tMI4EpJv1FuTB0iO19dRT55PF/+V1Hm1eLqP2+qYt8tPiR0mF8tXiz+27rqElq/rDf66iWbBy9ZLq69x3ckus8ezpc//mBNs3I/UBB9+acfralybs7mtLNEdoUQSR8Gzi3dBoqtJJs7eWbBlqACdBlvd/uigCVvGtR+sSK79kpg/SW52+C+EEk7YgegfptGsRZmpRoAwO9nrAEEAH07PcAV7qQNGsRdfh7829Z7/Hfb8Rdw9zUUgeYZi4K8c56xJPCA9W71EYqL77iaBiXf7brC4+XXuimzpgPC47cnh0HhKzr//UtbnkJo+D1XIELgd1tbWJSFbpQgyPtuFGWge2aCu9FROFT8jHVViTvvYK3gcOftFj+mKLb0mbSgBKxvrwRcrpwMWr0dL5qCFpsAYwnW4MPPWIz155XTl3+2pgogzrcXrwPWvCkN43HV3jTMeGSvfOfDKsBNmy4U0JAeAN/7GtRnM5DYvY2dfoSpdDoxMaHcDjT/YAYDhTGlVcP50GcHBJ1NMwjF3UH7hABjlZJ50Ya2c/NZE9nvoPMHnPcuKxqP7e6AUg217qpRDghy0d19T2oW0L3jEYvBbnAxWWQY9y4srQHcVTPEetIxkfN9j5MEI4CZWc2oMcgYTjQ5h4vhRlXWwO7gqJu1CsW+6HJmq2AvXJzZCvQLF4RKrBq3FrkmyN+tQQ4AdzeuwOxQzmO8g7sAC31WHMWcjJKM6e6EaJp1M0XycO7t6cgA7i6MPDBsu0vKPFi7A8oyTrtCwH+wFvB+Ln6N9tc1znt7IZGR3dvv0gGnjFZHuwMBc+bYHqohnPb5H63b87zrEfo9cFVkMFlthw3DWT8OXfuhs7OvWexUStB3t5sgCTKnC3lb6VMgqB8FsIP5zehW0ew00EC3t1/G0P1gZ/NNg+E+gtA+G3GFVhrLCwFbFsrY5TPm3+jTfUxHyQMWbUdFw8Kst1c1DL66E6sPg6s+VSuGy8Oo23sb19cpLo31jm25kzc3Or+Keq62R9ulDMQqP65mU1vNzNSzs8XsqOiPiv6o6HGiE1D03T0MxvaIcHtjqryUt11E8Gtjp+fI/Mtx5R3Z5Gx8sdrD7gvBHJmxFDi1x6JC1uEyqadrJBm9YcaD2PfljQ41fMasG9GYpTWEtjFR8wDmjomDPvouBQ3FB5+xhPU9OVWY3TNmmwiHYjc/+dKdpulkvd5hWPEOfksNoHh7Gm3PgcbSrgLlnrG0A6DevW9mcUTsGTNysrOVg+K2aw1TtFMTINhuu5bIFDrG7YhY344MSA3Wd6/mAAgwe8ZThwHe7miP4TG37USMLdtR2kuwbo1Ime2qD3jd9uTaB/e2xdQwxIaUCyIAb3rZhGu0VS4yjQle7TgO8207xsYgmg5HebKL62RH2hi/2nRi45jTcm4c+tlkQjc12c7iqmCnAWWbblf/oeQg+AuOAvdba2wzNTBTBT4RfWNlJ21rWMaxVQFpgXF39aM8orWzabOlTJXF+hgtJeyv2aBpMXsdLr6TMYiNvtgyyLD1/jzHIbxBQUnfRP4iFyQOt7Rqfg6+esJ+vt6HWbDLX2vNns6XpxJC8IeoPKIsSlA9StNLN578UFUBkou1owROZJtQfeFr/4NElAoSScqm0tNzrs8C+YGgj0kQbYKdF8q9FrKank7z7jRUxZQ6qCfjOmdSk4C4KNfZkBZYq2MDBx+slh0WFKwBskIFqEhkx638wA/bi5OTU2nkDjQ4GDKWFp/QiyhAAOe9CAGOtYZUyMGPjSIJBTB+1eS0mwT0pDaOkgNVyEC1jSI3Vi+UMaMpg7mxQwqkDiJjsBVK2TJoBjiSOg3gXU8iaPRWXZeD3KhiCT0JMBEFNy3hG0zltZe3cTWf5Ut8zEBDdhN2mMH0QUQQs9FqWtejGBo8Q9WLVBq+0NjNPD2ymE5YF05PEAfTh10kbxIa8aaOntEMLjSYw4pXBaQCtKNO6VOnDSlNEGQMUiPrGz+qGHEoTZOXJQbdBWgLm/pcZArDs5m4XFm8iCuPMuinxg60kGFICVTdt+paKmbvU0YVSDT9CqzFg8rI+Vbx6vHoAqzZzRkLxFFoFUI7J3FVv349lrzCvvoTXNC7qfr5Luv26nkqK3sOdTQf+SqAmYBWlN+fizTJ8FNzEKLu16CqO9DxBGBoI4bx6E/CcFHhy8xHhdSAOEBDmqTnokhA8B+kyqnoklqgeveqGFsehtYrNsIwCdVS65R8YGZgzCrAPoBWlN+fi0qRIU2Q+qaiTxqoCpdLlJlqkVAyWJJM4nORDQTtRC0gN6NLyGBLjYlkzXRxmc+qwl3qVt+0q8t03Q4GlKmR3Qrm50YgO1QBzXsuXn+6mWJW4Dn7BLadP5N2EQQl2uxaZYJKdU5SPZY6dibXk9LVhS9/3kGtPh7TxasJGBTrLz/OeysJR0MilU0g8qOUFo2uk0YLGqlnJC3GAziotCABsANKCw+H6OSypDeZEaAbxZaIyfPXOiqsSqTacfXPIQ5yupJkHTo7N8mxjJIdWWIO8dw3115E9136mAsWXZMbQvb7MLIkhN4jrenRlR1FGu1LuFRgA0idWnSB0QRtwlET44vWcAqrhUxNQmsJF4IK8Jw5GBkEAF5A4J6nHVcFPIxUOSkTAavZtBcHk1s7RxO3kVZOGzGbxMJZNZhF2W2QXCe5cgINhjQsnz7vFRTqkkm9HJjvZKTreSyn0xHDkS9IraVyUqsrJKACfPRRCyrFb/JaEMITH1PWytE/IEhPWb4q7HAwTLZMeRYyBUGkIzXyoOETkCNTZyLboZycc5n9WI3gAlQNylDC8aZAnqRlMlqCJPXBIvbJ2yApXhfwbj0JxLkstSaZZNdfLt40WJaA5Xy9eSBb73zp38Z04EtEzEN6CogLX1GFHinVUX2HyBdJesqlapQIl58hunmKniwPWCeR55Ohatgc+uoAtyqpTiAPVLGUTV87uJmW6gdzQS2AfHRM24DXq6zLmH4NGoLVUqcr6moeHjarkYWVwGpl8yhq5tA2DKsXImCxFgjZFI3gcto2Q9sAk6qNKy2j9LAay1RFdXkG47qa4B2suiaDosYyj8XolsEeWJVlqqK+MtTFsC4mggCrkMmiqLXJZaAXC88RWRUWn0HtlzvJGC0aolsBuISImbAFhctnMn6cXVZeetlUcO09ZDCuC9ewYgZFjcb6VngITa5UzABVyucxllT+8IsJK59LIa9sRgu1X+6tcZVfpivVfZ6lxeYB2RMh+Yw2ESUcXZudBNIYNKfhjsKuQUpMEqM10X6ZKssZr1lmrr36QTXepkkl7TZsB8c+UHPiKrpOtVKSiBRJOTTKsvYQkKpmjlnCqYWF7V8w2dgTDArtz9+MSactWhX/WTo5HkpzR6iiYPVFNO7wXTHoJowwD/TVAIoesGMxLS4/KDoJHbuKknxC5y7zUOpAVxVY6zPpog71G+i0FVA41yn0/Fr0DEhVMEi5nMH0IKa7ZFnlT2TDMsgFqaPkjMcYYE3RS5O+EN5VxdpXdBRMV7BOsy/BaPbPPlyy9IVcytYkGNSg0uLsgIFrYQO13HQTFvAWIrZ0neKsu7w9B+8zjrLqsuOyoYqlwKa6YoAa5hNniAU8KNRR0CTG9lXIoGedwfECpS9m75m5WoVjAV2pYIWi28+Doc3EMmQkcqXkbvp2k+r2bOEQ/XBu4MB/LpnAWnzZsuV3p13GDklSnh6W6WG6KWKt4Z1VorK5HF/Bys4Wb5Jcd18z0DiAmJuxHrLLPASWYkfC5etttNnbDbZs+d1Vp2XEJrzjGnQnl52XrltYAkyis7HXyHlvAm7CIEeHrsPthdl5q8k/+Em1J6bYQcQY2TtUBEYyGOnGxKzAUMy2MS6pCAwno1NluAyqgVl2ceSNjjpNvBVpSpUfXXYRlxsNXAQ/lmJjoYYO3kUIvgDpqBbpwMGIwr4CTXkxuTMLxHh7oOvKkPyOXba+qGrTRUWAONRd03hyviOyl0XZE/a7ihHwBaRIw5EVVBXKbMqSHkzDozBBOGjwCwXKC1Wp4ZZH2N+G5Ze7DR0YJKoRFoNdraOJMwgLKkpwICO+0TcIfHRzvoG8kVi54tN7YYfhLDItOvhpaAIsFGPDDNmnDCmbs3xJwUw4Q9RxT26YwLvb8RdXZYrjjhuYEpRxOi460YPhII8N4yJLmrSzVelbVX2gP7M4ocSvY5+EafH1bPVpT0tvSfnrNUmD+wOJM0ozIkVo2oFonecquovr2BqhRXWWOrkajmuSeb6XeRdJFtx5m4wmb0iaFr6kv3rhvnC1uSX+VfRhn+32Ge0y2d6G3PY8D8xR1X+2ktp89mFXnLpddIE2M6BdIB+in/ZB6DftfuuF4sUVRiKP+PmZ0O/lWOY6ldw/NZTex5EhoYp9TaDSZ7LdhZRY+iFae19Jm7bRufuO3HubJ/r9a+DnExkjoh8Inu1nrwPvPvG2aUXjUJ7+pDLsbx//+v/zY1sL5R4CAA==</value>
+  </data>
+  <data name="DefaultSchema" xml:space="preserve">
+    <value>dbo</value>
+  </data>
+</root>
\ No newline at end of file
diff --git a/src/NuGetGallery/NuGetGallery.csproj b/src/NuGetGallery/NuGetGallery.csproj
index 428503152a..40c15dc526 100644
--- a/src/NuGetGallery/NuGetGallery.csproj
+++ b/src/NuGetGallery/NuGetGallery.csproj
@@ -804,6 +804,10 @@
     <Compile Include="Migrations\201709111714021_AddPackageStatusKey.Designer.cs">
       <DependentUpon>201709111714021_AddPackageStatusKey.cs</DependentUpon>
     </Compile>
+    <Compile Include="Migrations\201709202249402_AddPackageOwnershipRequestsPage.cs" />
+    <Compile Include="Migrations\201709202249402_AddPackageOwnershipRequestsPage.Designer.cs">
+      <DependentUpon>201709202249402_AddPackageOwnershipRequestsPage.cs</DependentUpon>
+    </Compile>
     <Compile Include="RequestModels\ReadMeRequest.cs" />
     <Compile Include="Security\RequireSecurePushForCoOwnersPolicy.cs" />
     <Compile Include="Security\SecurePushSubscription.cs" />
@@ -821,7 +825,9 @@
     <Compile Include="Security\UserSecurityPolicyEvaluationContext.cs" />
     <Compile Include="Security\SecurityPolicyResult.cs" />
     <Compile Include="Security\UserSecurityPolicySubscriptionContext.cs" />
+    <Compile Include="Services\IPackageOwnerRequestService.cs" />
     <Compile Include="Services\IReadMeService.cs" />
+    <Compile Include="Services\PackageOwnerRequestService.cs" />
     <Compile Include="Services\PackageUploadService.cs" />
     <Compile Include="Services\IReservedNamespaceService.cs" />
     <Compile Include="Services\IPackageUploadService.cs" />
@@ -1522,6 +1528,9 @@
     <Compile Include="ViewModels\ManagePackagesListViewModel.cs" />
     <Compile Include="ViewModels\ApiKeyListViewModel.cs" />
     <Compile Include="ViewModels\ApiKeyViewModel.cs" />
+    <Compile Include="ViewModels\OwnerRequestsListItemViewModel.cs" />
+    <Compile Include="ViewModels\OwnerRequestsListViewModel.cs" />
+    <Compile Include="ViewModels\OwnerRequestsViewModel.cs" />
     <Compile Include="ViewModels\PackageHeadingModel.cs" />
     <Compile Include="ViewModels\PackageManagerViewModel.cs" />
     <Compile Include="ViewModels\ReportMyPackageViewModel.cs" />
@@ -1815,6 +1824,9 @@
     <EmbeddedResource Include="Migrations\201709111714021_AddPackageStatusKey.resx">
       <DependentUpon>201709111714021_AddPackageStatusKey.cs</DependentUpon>
     </EmbeddedResource>
+    <EmbeddedResource Include="Migrations\201709202249402_AddPackageOwnershipRequestsPage.resx">
+      <DependentUpon>201709202249402_AddPackageOwnershipRequestsPage.cs</DependentUpon>
+    </EmbeddedResource>
     <EmbeddedResource Include="OData\QueryAllowed\Data\apiv1packages.json" />
     <EmbeddedResource Include="OData\QueryAllowed\Data\apiv1search.json" />
     <EmbeddedResource Include="OData\QueryAllowed\Data\apiv2getupdates.json" />
@@ -1872,6 +1884,8 @@
     <Content Include="Views\Packages\_ImportReadMe.cshtml" />
     <Content Include="Views\Packages\_SubmitPackage.cshtml" />
     <Content Include="Views\Packages\_EditForm.cshtml" />
+    <Content Include="Views\Users\OwnerRequests.cshtml" />
+    <Content Include="Views\Users\_OwnerRequestsList.cshtml" />
   </ItemGroup>
   <ItemGroup>
     <CodeAnalysisDictionary Include="Properties\CodeAnalysisDictionary.xml" />
diff --git a/src/NuGetGallery/RouteNames.cs b/src/NuGetGallery/RouteNames.cs
index e73ffccbb3..24b76319a1 100644
--- a/src/NuGetGallery/RouteNames.cs
+++ b/src/NuGetGallery/RouteNames.cs
@@ -22,11 +22,12 @@ public static class RouteName
         public const string Authentication = "SignIn";
         public const string UploadPackage = "UploadPackage";
         public const string UploadPackageProgress = "UploadPackageProgress";
-        public const string ManagePackageOwners = "ManagePackageOwners";
         public const string PackageVersionAction = "PackageVersionAction";
         public const string PackageFilePathAction = "PackageFilePathAction";
         public const string PackageFileContentsAction = "PackageFileContentsAction";
         public const string PackageOwnerConfirmation = "PackageOwnerConfirmation";
+        public const string PackageOwnerRejection = "PackageOwnerRejection";
+        public const string PackageOwnerCancellation = "PackageOwnerCancellation";
         public const string PackageAction = "PackageAction";
         public const string PushPackageApi = "PushPackageApi";
         public const string PublishPackageApi = "PublishPackageApi";
diff --git a/src/NuGetGallery/Scripts/gallery/page-manage-packages.js b/src/NuGetGallery/Scripts/gallery/page-manage-packages.js
index 29a6d02177..0f75fa69f7 100644
--- a/src/NuGetGallery/Scripts/gallery/page-manage-packages.js
+++ b/src/NuGetGallery/Scripts/gallery/page-manage-packages.js
@@ -1,16 +1,9 @@
 $(function () {
     'use strict';
 
-    window.nuget.configureExpander(
-        "packages-Published",
-        "ChevronRight",
-        "My Published Packages",
-        "ChevronDown",
-        "My Published Packages");
-    window.nuget.configureExpander(
-        "packages-Unlisted",
-        "ChevronRight",
-        "My Unlisted Packages",
-        "ChevronDown",
-        "My Unlisted Packages");
+    window.nuget.configureExpanderHeading("packages-Published");
+    window.nuget.configureExpanderHeading("packages-Unlisted");
+
+    window.nuget.configureExpanderHeading("requests-Incoming");
+    window.nuget.configureExpanderHeading("requests-Outgoing");
 });
diff --git a/src/NuGetGallery/Services/ConfirmOwnershipResult.cs b/src/NuGetGallery/Services/ConfirmOwnershipResult.cs
index ee649511ed..3e7e984cf2 100644
--- a/src/NuGetGallery/Services/ConfirmOwnershipResult.cs
+++ b/src/NuGetGallery/Services/ConfirmOwnershipResult.cs
@@ -8,6 +8,8 @@ public enum ConfirmOwnershipResult
         Success,
         Failure,
         NotYourRequest,
-        AlreadyOwner
+        AlreadyOwner,
+        Rejected,
+        Cancelled
     }
 }
diff --git a/src/NuGetGallery/Services/IMessageService.cs b/src/NuGetGallery/Services/IMessageService.cs
index fb662a2b3d..982fe641e3 100644
--- a/src/NuGetGallery/Services/IMessageService.cs
+++ b/src/NuGetGallery/Services/IMessageService.cs
@@ -15,7 +15,9 @@ public interface IMessageService
         void SendEmailChangeConfirmationNotice(MailAddress newEmailAddress, string confirmationUrl);
         void SendPasswordResetInstructions(User user, string resetPasswordUrl, bool forgotPassword);
         void SendEmailChangeNoticeToPreviousEmailAddress(User user, string oldEmailAddress);
-        void SendPackageOwnerRequest(User fromUser, User toUser, PackageRegistration package, string packageUrl, string confirmationUrl, string message, string policyMessage);
+        void SendPackageOwnerRequest(User fromUser, User toUser, PackageRegistration package, string packageUrl, string confirmationUrl, string rejectionUrl, string message, string policyMessage);
+        void SendPackageOwnerRequestRejectionNotice(User requestingOwner, User newOwner, PackageRegistration package);
+        void SendPackageOwnerRequestCancellationNotice(User requestingOwner, User newOwner, PackageRegistration package);
         void SendPackageOwnerAddedNotice(User toUser, User newOwner, PackageRegistration package, string packageUrl, string policyMessage);
         void SendPackageOwnerRemovedNotice(User fromUser, User toUser, PackageRegistration package);
         void SendCredentialRemovedNotice(User user, Credential removed);
diff --git a/src/NuGetGallery/Services/IPackageOwnerRequestService.cs b/src/NuGetGallery/Services/IPackageOwnerRequestService.cs
new file mode 100644
index 0000000000..ecf67579dd
--- /dev/null
+++ b/src/NuGetGallery/Services/IPackageOwnerRequestService.cs
@@ -0,0 +1,44 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Collections.Generic;
+using System.Threading.Tasks;
+
+namespace NuGetGallery
+{
+    public interface IPackageOwnerRequestService
+    {
+        /// <summary>
+        /// Gets <see cref="PackageOwnerRequest"/>s that match the provided conditions.
+        /// </summary>
+        /// <param name="package">If nonnull, only returns <see cref="PackageOwnerRequest"/>s that are for this package.</param>
+        /// <param name="requestingOwner">If nonnull, only returns <see cref="PackageOwnerRequest"/>s that were requested by this owner.</param>
+        /// <param name="newOwner">If nonnull, only returns <see cref="PackageOwnerRequest"/>s that are for this user to become an owner.</param>
+        /// <returns>An <see cref="IEnumerable{PackageOwnerRequest}"/> containing all objects that matched the conditions.</returns>
+        IEnumerable<PackageOwnerRequest> GetPackageOwnershipRequests(PackageRegistration package = null, User requestingOwner = null, User newOwner = null);
+
+        /// <summary>
+        /// Checks if the pending owner has a request for this package which matches the specified token.
+        /// </summary>
+        /// <param name="package">Package associated with the request.</param>
+        /// <param name="pendingOwner">Pending owner for the request.</param>
+        /// <param name="token">Token generated for the owner request.</param>
+        /// <returns>The <see cref="PackageOwnerRequest"/> if one exists or null otherwise.</returns>
+        PackageOwnerRequest GetPackageOwnershipRequest(PackageRegistration package, User pendingOwner, string token);
+
+        /// <summary>
+        /// Creates a <see cref="PackageOwnerRequest"/> with the given parameters.
+        /// </summary>
+        /// <param name="package">The package that the <see cref="PackageOwnerRequest"/> will pertain to.</param>
+        /// <param name="requestingOwner">The owner creating this <see cref="PackageOwnerRequest"/>.</param>
+        /// <param name="newOwner">The user to be added as an owner by this <see cref="PackageOwnerRequest"/>.</param>
+        /// <returns>A <see cref="PackageOwnerRequest"/> with the given parameters.</returns>
+        Task<PackageOwnerRequest> AddPackageOwnershipRequest(PackageRegistration package, User requestingOwner, User newOwner);
+
+        /// <summary>
+        /// Deletes the provided <see cref="PackageOwnerRequest"/>.
+        /// </summary>
+        /// <param name="request">The <see cref="PackageOwnerRequest"/> to delete.</param>
+        Task DeletePackageOwnershipRequest(PackageOwnerRequest request);
+    }
+}
diff --git a/src/NuGetGallery/Services/IPackageService.cs b/src/NuGetGallery/Services/IPackageService.cs
index 729a29bbbf..95ca7a0450 100644
--- a/src/NuGetGallery/Services/IPackageService.cs
+++ b/src/NuGetGallery/Services/IPackageService.cs
@@ -55,17 +55,6 @@ public interface IPackageService : ICorePackageService
         Task MarkPackageUnlistedAsync(Package package, bool commitChanges = true);
         Task MarkPackageListedAsync(Package package, bool commitChanges = true);
 
-        Task<PackageOwnerRequest> CreatePackageOwnerRequestAsync(PackageRegistration package, User currentOwner, User newOwner);
-        
-        /// <summary>
-        /// Checks if the pending owner has a request for this package which matches the specified token.
-        /// </summary>
-        /// <param name="package">Package associated with the request.</param>
-        /// <param name="pendingOwner">Pending owner for the request.</param>
-        /// <param name="token">Token generated for the owner request.</param>
-        /// <returns>True if valid, false otherwise.</returns>
-        bool IsValidPackageOwnerRequest(PackageRegistration package, User pendingOwner, string token);
-
         /// <summary>
         /// Performs database changes to add a new package owner while removing the corresponding package owner request.
         /// </summary>
diff --git a/src/NuGetGallery/Services/MessageService.cs b/src/NuGetGallery/Services/MessageService.cs
index 51df153e63..15de439b35 100644
--- a/src/NuGetGallery/Services/MessageService.cs
+++ b/src/NuGetGallery/Services/MessageService.cs
@@ -285,7 +285,7 @@ public void SendPasswordResetInstructions(User user, string resetPasswordUrl, bo
             }
         }
 
-        public void SendPackageOwnerRequest(User fromUser, User toUser, PackageRegistration package, string packageUrl, string confirmationUrl, string message, string policyMessage)
+        public void SendPackageOwnerRequest(User fromUser, User toUser, PackageRegistration package, string packageUrl, string confirmationUrl, string rejectionUrl, string message, string policyMessage)
         {
             if (!toUser.EmailAllowed)
             {
@@ -300,13 +300,16 @@ public void SendPackageOwnerRequest(User fromUser, User toUser, PackageRegistrat
             const string subject = "[{0}] The user '{1}' would like to add you as an owner of the package '{2}'.";
 
             string body = string.Format(CultureInfo.CurrentCulture, $@"The user '{fromUser.Username}' wants to add you as an owner of the package '{package.Id}'.
-If you do not want to be listed as an owner of this package, simply delete this email.
 
 Package URL on NuGet.org: [{packageUrl}]({packageUrl})
 {policyMessage}
 To accept this request and become a listed owner of the package, click the following URL:
 
-[{confirmationUrl}]({confirmationUrl})");
+[{confirmationUrl}]({confirmationUrl})
+
+If you do not want to be listed as an owner of this package, click the following URL:
+
+[{rejectionUrl}]({rejectionUrl})");
 
             if (!string.IsNullOrWhiteSpace(message))
             {
@@ -330,6 +333,58 @@ public void SendPackageOwnerRequest(User fromUser, User toUser, PackageRegistrat
             }
         }
 
+        public void SendPackageOwnerRequestRejectionNotice(User requestingOwner, User newOwner, PackageRegistration package)
+        {
+            if (!requestingOwner.EmailAllowed)
+            {
+                return;
+            }
+
+            var subject = string.Format(CultureInfo.CurrentCulture, $"[{Config.GalleryOwner.DisplayName}] The user '{newOwner.Username}' has rejected your request to add them as an owner of the package '{package.Id}'.");
+
+            var body = string.Format(CultureInfo.CurrentCulture, $@"The user '{newOwner.Username}' has rejected your request to add them as an owner of the package '{package.Id}'.
+
+Thanks,
+The {Config.GalleryOwner.DisplayName} Team");
+
+            using (var mailMessage = new MailMessage())
+            {
+                mailMessage.Subject = subject;
+                mailMessage.Body = body;
+                mailMessage.From = Config.GalleryNoReplyAddress;
+                mailMessage.ReplyToList.Add(newOwner.ToMailAddress());
+
+                mailMessage.To.Add(requestingOwner.ToMailAddress());
+                SendMessage(mailMessage);
+            }
+        }
+
+        public void SendPackageOwnerRequestCancellationNotice(User requestingOwner, User newOwner, PackageRegistration package)
+        {
+            if (!newOwner.EmailAllowed)
+            {
+                return;
+            }
+
+            var subject = string.Format(CultureInfo.CurrentCulture, $"[{Config.GalleryOwner.DisplayName}] The user '{requestingOwner.Username}' has cancelled their request for you to be added as an owner of the package '{package.Id}'.");
+
+            var body = string.Format(CultureInfo.CurrentCulture, $@"The user '{requestingOwner.Username}' has cancelled their request for you to be added as an owner of the package '{package.Id}'.
+
+Thanks,
+The {Config.GalleryOwner.DisplayName} Team");
+
+            using (var mailMessage = new MailMessage())
+            {
+                mailMessage.Subject = subject;
+                mailMessage.Body = body;
+                mailMessage.From = Config.GalleryNoReplyAddress;
+                mailMessage.ReplyToList.Add(requestingOwner.ToMailAddress());
+
+                mailMessage.To.Add(newOwner.ToMailAddress());
+                SendMessage(mailMessage);
+            }
+        }
+
         public void SendPackageOwnerAddedNotice(User toUser, User newOwner, PackageRegistration package, string packageUrl, string policyMessage)
         {
             if (!toUser.EmailAllowed)
diff --git a/src/NuGetGallery/Services/PackageOwnerRequestService.cs b/src/NuGetGallery/Services/PackageOwnerRequestService.cs
new file mode 100644
index 0000000000..5fd996fffc
--- /dev/null
+++ b/src/NuGetGallery/Services/PackageOwnerRequestService.cs
@@ -0,0 +1,97 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace NuGetGallery
+{
+    public class PackageOwnerRequestService : IPackageOwnerRequestService
+    {
+        private readonly IEntityRepository<PackageOwnerRequest> _packageOwnerRequestRepository;
+
+        public PackageOwnerRequestService(IEntityRepository<PackageOwnerRequest> packageOwnerRequestRepository)
+        {
+            _packageOwnerRequestRepository = packageOwnerRequestRepository ?? throw new ArgumentNullException(nameof(packageOwnerRequestRepository));
+        }
+
+        public PackageOwnerRequest GetPackageOwnershipRequest(PackageRegistration package, User newOwner, string token)
+        {
+            if (package == null)
+            {
+                throw new ArgumentNullException(nameof(package));
+            }
+
+            if (newOwner == null)
+            {
+                throw new ArgumentNullException(nameof(newOwner));
+            }
+
+            if (String.IsNullOrEmpty(token))
+            {
+                throw new ArgumentNullException(nameof(token));
+            }
+
+            var request = GetPackageOwnershipRequests(package: package, newOwner: newOwner).FirstOrDefault();
+            if (request == null)
+            {
+                return null;
+            }
+
+            return request.ConfirmationCode == token ? request : null;
+        }
+
+        public IEnumerable<PackageOwnerRequest> GetPackageOwnershipRequests(PackageRegistration package = null, User requestingOwner = null, User newOwner = null)
+        {
+            var query = _packageOwnerRequestRepository.GetAll();
+
+            if (package != null)
+            {
+                query = query.Where(r => r.PackageRegistrationKey == package.Key);
+            }
+
+            if (requestingOwner != null)
+            {
+                query = query.Where(r => r.RequestingOwnerKey == requestingOwner.Key);
+            }
+
+            if (newOwner != null)
+            {
+                query = query.Where(r => r.NewOwnerKey == newOwner.Key);
+            }
+
+            return query.ToArray();
+        }
+
+        public async Task<PackageOwnerRequest> AddPackageOwnershipRequest(PackageRegistration package, User requestingOwner, User newOwner)
+        {
+            var existingRequest = GetPackageOwnershipRequests(package: package, newOwner: newOwner).FirstOrDefault();
+            if (existingRequest != null)
+            {
+                return existingRequest;
+            }
+
+            var newRequest = new PackageOwnerRequest
+            {
+                PackageRegistrationKey = package.Key,
+                RequestingOwnerKey = requestingOwner.Key,
+                NewOwnerKey = newOwner.Key,
+                ConfirmationCode = CryptographyService.GenerateToken(),
+                RequestDate = DateTime.UtcNow
+            };
+
+            _packageOwnerRequestRepository.InsertOnCommit(newRequest);
+            await _packageOwnerRequestRepository.CommitChangesAsync();
+            return newRequest;
+        }
+
+        public async Task DeletePackageOwnershipRequest(PackageOwnerRequest request)
+        {
+            _packageOwnerRequestRepository.DeleteOnCommit(request);
+            await _packageOwnerRequestRepository.CommitChangesAsync();
+        }
+        
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/PackageService.cs b/src/NuGetGallery/Services/PackageService.cs
index 6fa7920f54..ea1d6933eb 100644
--- a/src/NuGetGallery/Services/PackageService.cs
+++ b/src/NuGetGallery/Services/PackageService.cs
@@ -18,15 +18,15 @@ namespace NuGetGallery
     public class PackageService : CorePackageService, IPackageService
     {
         private readonly IIndexingService _indexingService;
-        private readonly IEntityRepository<PackageOwnerRequest> _packageOwnerRequestRepository;
         private readonly IEntityRepository<PackageRegistration> _packageRegistrationRepository;
+        private readonly IPackageOwnerRequestService _packageOwnerRequestService;
         private readonly IPackageNamingConflictValidator _packageNamingConflictValidator;
         private readonly IAuditingService _auditingService;
 
         public PackageService(
             IEntityRepository<PackageRegistration> packageRegistrationRepository,
             IEntityRepository<Package> packageRepository,
-            IEntityRepository<PackageOwnerRequest> packageOwnerRequestRepository,
+            IPackageOwnerRequestService packageOwnerRequestService,
             IIndexingService indexingService,
             IPackageNamingConflictValidator packageNamingConflictValidator,
             IAuditingService auditingService) : base(packageRepository)
@@ -41,9 +41,9 @@ public PackageService(
                 throw new ArgumentNullException(nameof(packageRepository));
             }
 
-            if (packageOwnerRequestRepository == null)
+            if (packageOwnerRequestService == null)
             {
-                throw new ArgumentNullException(nameof(packageOwnerRequestRepository));
+                throw new ArgumentNullException(nameof(packageOwnerRequestService));
             }
 
             if (indexingService == null)
@@ -62,7 +62,7 @@ public PackageService(
             }
 
             _packageRegistrationRepository = packageRegistrationRepository;
-            _packageOwnerRequestRepository = packageOwnerRequestRepository;
+            _packageOwnerRequestService = packageOwnerRequestService;
             _indexingService = indexingService;
             _packageNamingConflictValidator = packageNamingConflictValidator;
             _auditingService = auditingService;
@@ -401,11 +401,10 @@ public async Task AddPackageOwnerAsync(PackageRegistration package, User newOwne
             package.Owners.Add(newOwner);
             await _packageRepository.CommitChangesAsync();
 
-            var request = FindExistingPackageOwnerRequest(package, newOwner);
+            var request = _packageOwnerRequestService.GetPackageOwnershipRequests(package: package, newOwner: newOwner).FirstOrDefault();
             if (request != null)
             {
-                _packageOwnerRequestRepository.DeleteOnCommit(request);
-                await _packageOwnerRequestRepository.CommitChangesAsync();
+                await _packageOwnerRequestService.DeletePackageOwnershipRequest(request);
             }
 
             await _auditingService.SaveAuditRecordAsync(
@@ -419,11 +418,10 @@ public async Task RemovePackageOwnerAsync(PackageRegistration package, User user
                 throw new InvalidOperationException("You can't remove the only owner from a package.");
             }
 
-            var pendingOwner = FindExistingPackageOwnerRequest(package, user);
-            if (pendingOwner != null)
+            var request = _packageOwnerRequestService.GetPackageOwnershipRequests(package: package, newOwner: user).FirstOrDefault();
+            if (request != null)
             {
-                _packageOwnerRequestRepository.DeleteOnCommit(pendingOwner);
-                await _packageOwnerRequestRepository.CommitChangesAsync();
+                await _packageOwnerRequestService.DeletePackageOwnershipRequest(request);
                 return;
             }
 
@@ -499,49 +497,6 @@ public async Task MarkPackageUnlistedAsync(Package package, bool commitChanges =
             }
         }
 
-        public async Task<PackageOwnerRequest> CreatePackageOwnerRequestAsync(PackageRegistration package, User currentOwner, User newOwner)
-        {
-            var existingRequest = FindExistingPackageOwnerRequest(package, newOwner);
-            if (existingRequest != null)
-            {
-                return existingRequest;
-            }
-
-            var newRequest = new PackageOwnerRequest
-            {
-                PackageRegistrationKey = package.Key,
-                RequestingOwnerKey = currentOwner.Key,
-                NewOwnerKey = newOwner.Key,
-                ConfirmationCode = CryptographyService.GenerateToken(),
-                RequestDate = DateTime.UtcNow
-            };
-
-            _packageOwnerRequestRepository.InsertOnCommit(newRequest);
-            await _packageOwnerRequestRepository.CommitChangesAsync();
-            return newRequest;
-        }
-
-        public bool IsValidPackageOwnerRequest(PackageRegistration package, User pendingOwner, string token)
-        {
-            if (package == null)
-            {
-                throw new ArgumentNullException(nameof(package));
-            }
-
-            if (pendingOwner == null)
-            {
-                throw new ArgumentNullException(nameof(pendingOwner));
-            }
-
-            if (String.IsNullOrEmpty(token))
-            {
-                throw new ArgumentNullException(nameof(token));
-            }
-
-            var request = FindExistingPackageOwnerRequest(package, pendingOwner);
-            return (request != null && request.ConfirmationCode == token);
-        }
-
         private PackageRegistration CreateOrGetPackageRegistration(User currentUser, PackageMetadata packageMetadata, bool isVerified)
         {
             var packageRegistration = FindPackageRegistrationById(packageMetadata.Id);
@@ -783,14 +738,7 @@ private void ValidatePackageTitle(PackageMetadata packageMetadata)
                 throw new EntityException(Strings.TitleMatchesExistingRegistration, packageMetadata.Title);
             }
         }
-
-        private PackageOwnerRequest FindExistingPackageOwnerRequest(PackageRegistration package, User pendingOwner)
-        {
-            return (from request in _packageOwnerRequestRepository.GetAll()
-                    where request.PackageRegistrationKey == package.Key && request.NewOwnerKey == pendingOwner.Key
-                    select request).FirstOrDefault();
-        }
-
+        
         private void NotifyIndexingService()
         {
             _indexingService.UpdateIndex();
diff --git a/src/NuGetGallery/UrlExtensions.cs b/src/NuGetGallery/UrlExtensions.cs
index d936a28363..15e2214b71 100644
--- a/src/NuGetGallery/UrlExtensions.cs
+++ b/src/NuGetGallery/UrlExtensions.cs
@@ -612,31 +612,87 @@ public static string RemovePackageOwner(this UrlHelper url, bool relativeUrl = t
             return GetActionLink(url, "RemovePackageOwner", "JsonApi", relativeUrl);
         }
 
-        public static string ConfirmationUrl(
+        public static string ConfirmPendingOwnershipRequest(
+            this UrlHelper url,
+            string packageId,
+            string username,
+            string confirmationCode,
+            bool relativeUrl = true)
+        {
+            var routeValues = new RouteValueDictionary
+            {
+                ["id"] = packageId,
+                ["username"] = username,
+                ["token"] = confirmationCode
+            };
+
+            return GetActionLink(url, "ConfirmPendingOwnershipRequest", "Packages", relativeUrl, routeValues);
+        }
+
+        public static string RejectPendingOwnershipRequest(
+            this UrlHelper url,
+            string packageId,
+            string username,
+            string confirmationCode,
+            bool relativeUrl = true)
+        {
+            var routeValues = new RouteValueDictionary
+            {
+                ["id"] = packageId,
+                ["username"] = username,
+                ["token"] = confirmationCode
+            };
+
+            return GetActionLink(url, "RejectPendingOwnershipRequest", "Packages", relativeUrl, routeValues);
+        }
+
+        public static string CancelPendingOwnershipRequest(
+            this UrlHelper url,
+            string packageId,
+            string requestingUsername,
+            string pendingUsername,
+            bool relativeUrl = true)
+        {
+            var routeValues = new RouteValueDictionary
+            {
+                ["id"] = packageId,
+                ["requestingUsername"] = requestingUsername,
+                ["pendingUsername"] = pendingUsername
+            };
+
+            return GetActionLink(url, "CancelPendingOwnershipRequest", "Packages", relativeUrl, routeValues);
+        }
+
+        public static string ConfirmEmail(
             this UrlHelper url,
-            string action,
-            string controller,
             string username,
             string token,
             bool relativeUrl = true)
         {
-            return ConfirmationUrl(url, action, controller, username, token, routeValues: null, relativeUrl: relativeUrl);
+            var routeValues = new RouteValueDictionary
+            {
+                ["username"] = username,
+                ["token"] = token
+            };
+
+            return GetActionLink(url, "Confirm", "Users", relativeUrl, routeValues);
         }
 
-        public static string ConfirmationUrl(
+        public static string ResetEmailOrPassword(
             this UrlHelper url,
-            string action,
-            string controller,
             string username,
             string token,
-            object routeValues,
+            bool forgotPassword,
             bool relativeUrl = true)
         {
-            var rvd = routeValues == null ? new RouteValueDictionary() : new RouteValueDictionary(routeValues);
-            rvd["username"] = username;
-            rvd["token"] = token;
+            var routeValues = new RouteValueDictionary
+            {
+                ["username"] = username,
+                ["token"] = token,
+                ["forgot"] = forgotPassword
+            };
 
-            return GetActionLink(url, action, controller, relativeUrl, rvd);
+            return GetActionLink(url, "ResetPassword", "Users", relativeUrl, routeValues);
         }
 
         public static string VerifyPackage(this UrlHelper url, bool relativeUrl = true)
diff --git a/src/NuGetGallery/ViewModels/ManagePackagesViewModel.cs b/src/NuGetGallery/ViewModels/ManagePackagesViewModel.cs
index bc79a545c9..8ab5a563f9 100644
--- a/src/NuGetGallery/ViewModels/ManagePackagesViewModel.cs
+++ b/src/NuGetGallery/ViewModels/ManagePackagesViewModel.cs
@@ -1,5 +1,6 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
 using System.Collections.Generic;
 
 namespace NuGetGallery
@@ -7,5 +8,7 @@ namespace NuGetGallery
     public class ManagePackagesViewModel
     {
         public IEnumerable<ListPackageItemViewModel> Packages { get; set; }
+
+        public OwnerRequestsViewModel OwnerRequests { get; set; }
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/ViewModels/OwnerRequestsListItemViewModel.cs b/src/NuGetGallery/ViewModels/OwnerRequestsListItemViewModel.cs
new file mode 100644
index 0000000000..0ba6842bd4
--- /dev/null
+++ b/src/NuGetGallery/ViewModels/OwnerRequestsListItemViewModel.cs
@@ -0,0 +1,23 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Web;
+
+namespace NuGetGallery
+{
+    public class OwnerRequestsListItemViewModel
+    {
+        public PackageOwnerRequest Request { get; }
+
+        public Package Package { get; }
+        
+        public OwnerRequestsListItemViewModel(PackageOwnerRequest request, IPackageService packageService)
+        {
+            Request = request;
+            Package = packageService.FindPackageByIdAndVersion(request.PackageRegistration.Id, version: null, semVerLevelKey: SemVerLevelKey.SemVer2, allowPrerelease: true);
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/ViewModels/OwnerRequestsListViewModel.cs b/src/NuGetGallery/ViewModels/OwnerRequestsListViewModel.cs
new file mode 100644
index 0000000000..ec990999ed
--- /dev/null
+++ b/src/NuGetGallery/ViewModels/OwnerRequestsListViewModel.cs
@@ -0,0 +1,24 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Collections.Generic;
+using System.Linq;
+
+namespace NuGetGallery
+{
+    public class OwnerRequestsListViewModel
+    {
+        public IEnumerable<OwnerRequestsListItemViewModel> RequestItems { get; }
+
+        public string Name { get; }
+
+        public User CurrentUser { get; }
+        
+        public OwnerRequestsListViewModel(IEnumerable<PackageOwnerRequest> requests, string name, User currentUser, IPackageService packageService)
+        {
+            RequestItems = requests.Select(r => new OwnerRequestsListItemViewModel(r, packageService)).ToArray();
+            Name = name;
+            CurrentUser = currentUser;
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/ViewModels/OwnerRequestsViewModel.cs b/src/NuGetGallery/ViewModels/OwnerRequestsViewModel.cs
new file mode 100644
index 0000000000..d6bf16231c
--- /dev/null
+++ b/src/NuGetGallery/ViewModels/OwnerRequestsViewModel.cs
@@ -0,0 +1,26 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Collections.Generic;
+
+namespace NuGetGallery
+{
+    public class OwnerRequestsViewModel
+    {
+        /// <summary>
+        /// A model to show the requests for this user to become an owner of a package.
+        /// </summary>
+        public OwnerRequestsListViewModel Incoming { get; }
+
+        /// <summary>
+        /// A model to show the requests this user has sent to other users to become owners.
+        /// </summary>
+        public OwnerRequestsListViewModel Outgoing { get; }
+
+        public OwnerRequestsViewModel(IEnumerable<PackageOwnerRequest> incoming, IEnumerable<PackageOwnerRequest> outgoing, User currentUser, IPackageService packageService)
+        {
+            Incoming = new OwnerRequestsListViewModel(incoming, nameof(Incoming), currentUser, packageService);
+            Outgoing = new OwnerRequestsListViewModel(outgoing, nameof(Outgoing), currentUser, packageService);
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Views/Packages/ConfirmOwner.cshtml b/src/NuGetGallery/Views/Packages/ConfirmOwner.cshtml
index b43cf648b5..48697707e7 100644
--- a/src/NuGetGallery/Views/Packages/ConfirmOwner.cshtml
+++ b/src/NuGetGallery/Views/Packages/ConfirmOwner.cshtml
@@ -9,61 +9,87 @@
 <section role="main" class="container main-container page-manage-owners">
     <div class="col-xs-12">
         <h1 class="text-center">
-            @if (Model.Result == ConfirmOwnershipResult.Success
-                || Model.Result == ConfirmOwnershipResult.AlreadyOwner)
+            @switch (Model.Result)
             {
-                @:Email Confirmed
-            }
-            else
-            {
-                @:Email Confirmation Failed
+                case ConfirmOwnershipResult.Success:
+                case ConfirmOwnershipResult.AlreadyOwner:
+                    @:Ownership Confirmed
+                    break;
+
+                case ConfirmOwnershipResult.Rejected:
+                    @:Ownership Rejected
+                    break;
+
+                case ConfirmOwnershipResult.Cancelled:
+                    @:Ownership Request Cancelled
+                    break;
+
+                default:
+                    @:Ownership Confirmation Failed
+                    break;
             }
         </h1>
     </div>
     <div class="@ViewHelpers.GetColumnClasses(ViewBag)">
-        @if (Model.Result == ConfirmOwnershipResult.Success)
-        {
-            <p class="text-center">
-                You are now an owner of the
-                '<strong><a href="@Url.Package(@Model.PackageId)" title="The @Model.PackageId package">@Model.PackageId</a></strong>' package!
-            </p>
-        }
-        else if (Model.Result == ConfirmOwnershipResult.AlreadyOwner)
+        @switch (Model.Result)
         {
-            @ViewHelpers.AlertInfo(
-                @<text>
-                    You are already an owner of the
-                    '<strong><a href="@Url.Package(@Model.PackageId)" title="The @Model.PackageId package">@Model.PackageId</a></strong>' package.
-                </text>
-            )
+            case ConfirmOwnershipResult.Success:
+                <p class="text-center">
+                    You are now an owner of the
+                    '<strong><a href="@Url.Package(@Model.PackageId)" title="The @Model.PackageId package">@Model.PackageId</a></strong>' package!
+                </p>
+                break;
 
-            <p class="text-center">
-                If you manage multiple accounts, make sure you sign in as the user who received the request before clicking the confirmation link.
-            </p>
-        }
-        else if (Model.Result == ConfirmOwnershipResult.NotYourRequest)
-        {
-            @* Note that we're not confirming that a request even exists for this user, it's just a string compare against the name in the URL *@
-            @ViewHelpers.AlertDanger(
-                @<text>
-                    This request link is for the user '@Model.Username'. If you wish to accept it,
-                    please sign in as that user and click the link again.
-                </text>
-            )
-        }
-        else
-        {
-            @ViewHelpers.AlertDanger(
-                @<text>
-                    Could not confirm package ownership for '@Model.PackageId'.
-                </text>
-            )
+            case ConfirmOwnershipResult.Rejected:
+                <p class="text-center">
+                    You have rejected a request to become an owner of the
+                    '<strong><a href="@Url.Package(@Model.PackageId)" title="The @Model.PackageId package">@Model.PackageId</a></strong>' package!
+                </p>
+                break;
+
+            case ConfirmOwnershipResult.Cancelled:
+                <p class="text-center">
+                    You have cancelled your request for <strong>@Model.Username</strong> to become an owner of the
+                    '<strong><a href="@Url.Package(@Model.PackageId)" title="The @Model.PackageId package">@Model.PackageId</a></strong>' package!
+                </p>
+                break;
+
+            case ConfirmOwnershipResult.AlreadyOwner:
+                @ViewHelpers.AlertInfo(
+                    @<text>
+                        You are already an owner of the
+                        '<strong><a href="@Url.Package(@Model.PackageId)" title="The @Model.PackageId package">@Model.PackageId</a></strong>' package.
+                    </text>
+                        )
+
+                <p class="text-center">
+                    If you manage multiple accounts, make sure you sign in as the user who received the request before clicking the confirmation link.
+                </p>
+                break;
+
+            case ConfirmOwnershipResult.NotYourRequest:
+                @* Note that we're not confirming that a request even exists for this user, it's just a string compare against the name in the URL *@
+                @ViewHelpers.AlertDanger(
+                    @<text>
+                        This request link is for the user '@Model.Username'. If you wish to accept it,
+                        please sign in as that user and click the link again.
+                    </text>
+                )
+                break;
+
+            default:
+                @ViewHelpers.AlertDanger(
+                    @<text>
+                        Could not confirm package ownership for '@Model.PackageId'.
+                    </text>
+                )
 
-            <p class="text-center">
-                Make sure you clicked on the confirmation URL in the email we sent.
-                It's also possible that the existing owner revoked the
-                request to add you as an owner.
-            </p>
+                <p class="text-center">
+                    Make sure you clicked on the confirmation URL in the email we sent.
+                    It's also possible that the existing owner revoked the
+                    request to add you as an owner.
+                </p>
+                break;
         }
     </div>
 </section>
\ No newline at end of file
diff --git a/src/NuGetGallery/Views/Users/Packages.cshtml b/src/NuGetGallery/Views/Users/Packages.cshtml
index c6bd706519..dcf200ea93 100644
--- a/src/NuGetGallery/Views/Users/Packages.cshtml
+++ b/src/NuGetGallery/Views/Users/Packages.cshtml
@@ -18,6 +18,20 @@
         @Html.Partial("_UserPackagesList", new ManagePackagesListViewModel(listedPackages, "Published"))
         @Html.Partial("_UserPackagesList", new ManagePackagesListViewModel(unlistedPackages, "Unlisted"))
     }
+
+    @{
+        if (Model.OwnerRequests.Incoming.RequestItems.Any() || Model.OwnerRequests.Outgoing.RequestItems.Any())
+        {
+            <div class="row">
+                <div class="col-xs-12">
+                    <h1>Manage Ownership Requests</h1>
+                </div>
+            </div>
+
+            @Html.Partial("_OwnerRequestsList", Model.OwnerRequests.Incoming)
+            @Html.Partial("_OwnerRequestsList", Model.OwnerRequests.Outgoing)
+        }
+    }
 </section>
 
 @section BottomScripts {
diff --git a/src/NuGetGallery/Views/Users/_OwnerRequestsList.cshtml b/src/NuGetGallery/Views/Users/_OwnerRequestsList.cshtml
new file mode 100644
index 0000000000..af016d854a
--- /dev/null
+++ b/src/NuGetGallery/Views/Users/_OwnerRequestsList.cshtml
@@ -0,0 +1,78 @@
+@model OwnerRequestsListViewModel
+@{
+    var requestsString = "request" + (Model.RequestItems.Count() != 1 ? "s" : "");
+
+    if (!Model.RequestItems.Any())
+    {
+        return;
+    }
+}
+
+<div class="row user-package-list">
+    <div class="col-md-12">
+        <h2>
+            <a href="#" role="button" data-toggle="collapse" data-target="#requests-@Model.Name"
+               aria-expanded="true" aria-controls="requests-@Model.Name" id="show-requests-@Model.Name">
+                <i class="ms-Icon ms-Icon--ChevronDown" aria-hidden="true"></i>
+                <span>Pending Ownership Requests (@Model.Name)</span>
+            </a>
+        </h2>
+        <div class="panel-collapse collapse in" id="requests-@Model.Name" aria-expanded="true">
+            <p>
+                You have <b>@Model.RequestItems.Count().ToNuGetNumberString() @Model.Name.ToLowerInvariant() @requestsString</b>
+            </p>
+            <div class="list-packages" role="list">
+                <table class="table">
+                    <thead>
+                        <tr class="manage-package-headings">
+                            <th class="hidden-xs"></th>
+                            <th>Package ID</th>
+                            <th>Existing Owner</th>
+                            <th>New Owner</th>
+                            <th></th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        @foreach (var requestItem in @Model.RequestItems)
+                        {
+                            var packageId = requestItem.Request.PackageRegistration.Id;
+
+                            <tr class="manage-package-listing">
+                                <td class="align-middle hidden-xs">
+                                    <img class="package-icon img-responsive" aria-hidden="true" alt=""
+                                         src="@(PackageHelper.ShouldRenderUrl(requestItem.Package.IconUrl) ? requestItem.Package.IconUrl : Url.Absolute("~/Content/gallery/img/default-package-icon.svg"))"
+                                         @ViewHelpers.ImageFallback(Url.Absolute("~/Content/gallery/img/default-package-icon-256x256.png")) />
+                                </td>
+                                <td class="align-middle package-id"><a href="@Url.Package(packageId)">@Html.BreakWord(packageId)</a></td>
+                                <td class="align-middle">
+                                    <a href="@Url.User(requestItem.Request.RequestingOwner)">@requestItem.Request.RequestingOwner.Username</a>
+                                </td>
+                                <td class="align-middle text-nowrap">
+                                    <a href="@Url.User(requestItem.Request.NewOwner)">@requestItem.Request.NewOwner.Username</a>
+                                </td>
+                                <td class="text-right align-middle package-controls">
+                                    @if (CurrentUser.Key == requestItem.Request.NewOwnerKey)
+                                    {
+                                        <a href="@Url.ConfirmPendingOwnershipRequest(packageId, CurrentUser.Username, requestItem.Request.ConfirmationCode)" class="btn" title="Confirm Ownership" aria-label="Confirm Ownership of @packageId">
+                                            <i class="ms-Icon ms-Icon--Accept" aria-hidden="true"></i>
+                                        </a>
+
+                                        <a href="@Url.RejectPendingOwnershipRequest(packageId, CurrentUser.Username, requestItem.Request.ConfirmationCode)" class="btn" title="Reject Ownership" aria-label="Reject Ownership Request of @packageId">
+                                            <i class="ms-Icon ms-Icon--Cancel" aria-hidden="true"></i>
+                                        </a>
+                                    }
+                                    else
+                                    {
+                                        <a href="@Url.CancelPendingOwnershipRequest(packageId, CurrentUser.Username, requestItem.Request.NewOwner.Username)" class="btn" title="Cancel Ownership" aria-label="Cancel Ownership Request of @requestItem.Request.NewOwner.Username to Own @packageId">
+                                            <i class="ms-Icon ms-Icon--Cancel" aria-hidden="true"></i>
+                                        </a>
+                                    }
+                                </td>
+                            </tr>
+                        }
+                    </tbody>
+                </table>
+            </div>
+        </div>
+    </div>
+</div>
\ No newline at end of file
diff --git a/tests/NuGetGallery.Facts/Controllers/JsonApiControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/JsonApiControllerFacts.cs
index 2b188e3288..6459bbef39 100644
--- a/tests/NuGetGallery.Facts/Controllers/JsonApiControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/JsonApiControllerFacts.cs
@@ -237,12 +237,15 @@ public void ReturnsDetailedConfirmationIfPendingOwnerPropagatesPolicy()
                 fakes.ShaUser.SecurityPolicies = (new RequireSecurePushForCoOwnersPolicy().Policies).ToList();
                 var pendingOwner = new PackageOwnerRequest()
                 {
+                    PackageRegistration = fakes.Package,
                     PackageRegistrationKey = fakes.Package.Key,
-                    NewOwner = fakes.ShaUser
+                    NewOwner = fakes.ShaUser,
+                    NewOwnerKey = fakes.ShaUser.Key
                 };
-                GetMock<IEntityRepository<PackageOwnerRequest>>()
-                    .Setup(r => r.GetAll())
-                    .Returns((new [] { pendingOwner }).AsQueryable());
+
+                GetMock<IPackageOwnerRequestService>()
+                    .Setup(p => p.GetPackageOwnershipRequests(fakes.Package, null, null))
+                    .Returns((new [] { pendingOwner }));
 
                 // Act
                 var result = controller.GetAddPackageOwnerConfirmation(fakes.Package.Id, fakes.User.Username);
@@ -272,9 +275,10 @@ public void DoesNotReturnConfirmationIfPendingOwnerPropagatesButNewOwnerIsSubscr
                     PackageRegistrationKey = fakes.Package.Key,
                     NewOwner = fakes.ShaUser
                 };
-                GetMock<IEntityRepository<PackageOwnerRequest>>()
-                    .Setup(r => r.GetAll())
-                    .Returns((new[] { pendingOwner }).AsQueryable());
+
+                GetMock<IPackageOwnerRequestService>()
+                    .Setup(p => p.GetPackageOwnershipRequests(fakes.Package, null, fakes.ShaUser))
+                    .Returns((new[] { pendingOwner }));
 
                 // Act
                 var result = controller.GetAddPackageOwnerConfirmation(fakes.Package.Id, fakes.User.Username);
@@ -413,9 +417,9 @@ public async Task CreatesPackageOwnerRequestSendsEmailAndReturnsPendingState()
                     .Returns(Fakes.ToPrincipal(fakes.Owner))
                     .Verifiable();
 
-                var packageServiceMock = GetMock<IPackageService>();
-                packageServiceMock
-                    .Setup(p => p.CreatePackageOwnerRequestAsync(fakes.Package, fakes.Owner, fakes.User))
+                var packageOwnerRequestServiceMock = GetMock<IPackageOwnerRequestService>();
+                packageOwnerRequestServiceMock
+                    .Setup(p => p.AddPackageOwnershipRequest(fakes.Package, fakes.Owner, fakes.User))
                     .Returns(Task.FromResult(new PackageOwnerRequest { ConfirmationCode = "confirmation-code" }))
                     .Verifiable();
 
@@ -427,6 +431,7 @@ public async Task CreatesPackageOwnerRequestSendsEmailAndReturnsPendingState()
                         fakes.Package,
                         TestUtility.GallerySiteRootHttps + "packages/FakePackage/",
                         TestUtility.GallerySiteRootHttps + "packages/FakePackage/owners/testUser/confirm/confirmation-code",
+                        TestUtility.GallerySiteRootHttps + "packages/FakePackage/owners/testUser/reject/confirmation-code",
                         "Hello World! Html Encoded &lt;3",
                         ""))
                     .Verifiable();
@@ -439,7 +444,7 @@ public async Task CreatesPackageOwnerRequestSendsEmailAndReturnsPendingState()
                 Assert.True(data.pending);
 
                 httpContextMock.Verify();
-                packageServiceMock.Verify();
+                packageOwnerRequestServiceMock.Verify();
                 messageServiceMock.Verify();
             }
 
@@ -474,15 +479,20 @@ public async Task SendsPackageOwnerRequestEmailWherePendingOwnerPropagatesPolicy
             {
                 // Arrange & Act
                 var fakes = Get<Fakes>();
-
-                var pendingOwner = new PackageOwnerRequest()
-                {
-                    PackageRegistrationKey = fakes.Package.Key,
-                    NewOwner = fakes.ShaUser
-                };
-                GetMock<IEntityRepository<PackageOwnerRequest>>()
-                    .Setup(r => r.GetAll())
-                    .Returns((new[] { pendingOwner }).AsQueryable());
+                
+                var packageOwnerRequestServiceMock = GetMock<IPackageOwnerRequestService>();
+                packageOwnerRequestServiceMock
+                    .Setup(p => p.GetPackageOwnershipRequests(fakes.Package, null, null))
+                    .Returns(
+                        new[]
+                        {
+                            new PackageOwnerRequest
+                            {
+                                PackageRegistration = fakes.Package,
+                                NewOwner = fakes.ShaUser
+                            }
+                        })
+                    .Verifiable();
 
                 var policyMessage = await GetSendPackageOwnerRequestPolicyMessage(fakes, fakes.ShaUser);
 
@@ -503,10 +513,17 @@ private async Task<string> GetSendPackageOwnerRequestPolicyMessage(Fakes fakes,
 
                 userToSubscribe.SecurityPolicies = (new RequireSecurePushForCoOwnersPolicy().Policies).ToList();
 
-                var packageServiceMock = GetMock<IPackageService>();
-                packageServiceMock
-                    .Setup(p => p.CreatePackageOwnerRequestAsync(fakes.Package, fakes.Owner, fakes.User))
-                    .Returns(Task.FromResult(new PackageOwnerRequest { ConfirmationCode = "confirmation-code" }))
+                var packageOwnerRequestServiceMock = GetMock<IPackageOwnerRequestService>();
+                packageOwnerRequestServiceMock
+                    .Setup(p => p.AddPackageOwnershipRequest(fakes.Package, fakes.Owner, fakes.User))
+                    .Returns(Task.FromResult(
+                        new PackageOwnerRequest
+                        {
+                            PackageRegistration = fakes.Package,
+                            RequestingOwner = fakes.Owner,
+                            NewOwner = fakes.User,
+                            ConfirmationCode = "confirmation-code"
+                        }))
                     .Verifiable();
 
                 string actualMessage = string.Empty;
@@ -517,10 +534,11 @@ private async Task<string> GetSendPackageOwnerRequestPolicyMessage(Fakes fakes,
                         fakes.Package,
                         TestUtility.GallerySiteRootHttps + "packages/FakePackage/",
                         TestUtility.GallerySiteRootHttps + "packages/FakePackage/owners/testUser/confirm/confirmation-code",
+                        TestUtility.GallerySiteRootHttps + "packages/FakePackage/owners/testUser/reject/confirmation-code",
                         string.Empty,
                         It.IsAny<string>()))
-                    .Callback<User, User, PackageRegistration, string, string, string, string>(
-                        (from, to, pkg, pkgUrl, cnfUrl, msg, policyMsg) => actualMessage = policyMsg);
+                    .Callback<User, User, PackageRegistration, string, string, string, string, string>(
+                        (from, to, pkg, pkgUrl, cnfUrl, rjUrl, msg, policyMsg) => actualMessage = policyMsg);
 
                 // Act
                 JsonResult result = await controller.AddPackageOwner(fakes.Package.Id, fakes.User.Username, string.Empty);
diff --git a/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
index 5dc030cfce..685da310be 100644
--- a/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
@@ -5,6 +5,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
+using System.Linq.Expressions;
 using System.Net.Mail;
 using System.Threading.Tasks;
 using System.Web;
@@ -12,6 +13,7 @@
 using System.Web.Routing;
 using Moq;
 using NuGet.Packaging;
+using NuGetGallery;
 using NuGetGallery.Areas.Admin;
 using NuGetGallery.AsyncFileUpload;
 using NuGetGallery.Auditing;
@@ -20,6 +22,7 @@
 using NuGetGallery.Helpers;
 using NuGetGallery.Packaging;
 using NuGetGallery.Security;
+using NuGetGallery.TestUtils;
 using Xunit;
 
 namespace NuGetGallery
@@ -30,7 +33,9 @@ public class PackagesControllerFacts
         private static PackagesController CreateController(
             IGalleryConfigurationService configurationService,
             Mock<IPackageService> packageService = null,
+            Mock<IPackageOwnerRequestService> packageOwnerRequestService = null,
             Mock<IUploadFileService> uploadFileService = null,
+            Mock<IUserService> userService = null,
             Mock<IMessageService> messageService = null,
             Mock<HttpContextBase> httpContext = null,
             Mock<EditPackageService> editPackageService = null,
@@ -51,6 +56,7 @@ private static PackagesController CreateController(
             Mock<IPackageUploadService> packageUploadService = null)
         {
             packageService = packageService ?? new Mock<IPackageService>();
+            packageOwnerRequestService = packageOwnerRequestService ?? new Mock<IPackageOwnerRequestService>();
             if (uploadFileService == null)
             {
                 uploadFileService = new Mock<IUploadFileService>();
@@ -58,6 +64,7 @@ private static PackagesController CreateController(
                 uploadFileService.Setup(x => x.GetUploadFileAsync(42)).Returns(Task.FromResult<Stream>(null));
                 uploadFileService.Setup(x => x.SaveUploadFileAsync(42, It.IsAny<Stream>())).Returns(Task.FromResult(0));
             }
+            userService = userService ?? new Mock<IUserService>();
             messageService = messageService ?? new Mock<IMessageService>();
             searchService = searchService ?? CreateSearchService();
             autoCuratePackageCmd = autoCuratePackageCmd ?? new Mock<IAutomaticallyCuratePackageCommand>();
@@ -104,7 +111,9 @@ private static PackagesController CreateController(
 
             var controller = new Mock<PackagesController>(
                 packageService.Object,
+                packageOwnerRequestService.Object,
                 uploadFileService.Object,
+                userService.Object,
                 messageService.Object,
                 searchService.Object,
                 autoCuratePackageCmd.Object,
@@ -583,11 +592,34 @@ private async Task<ActionResult> GetDisplayPackageResult(string readMeHtml, bool
             }
         }
 
-        public class TheConfirmOwnerMethod : TestContainer
+        public class TheOwnershipRequestMethods : TestContainer
         {
-            [Fact]
-            public async Task WithEmptyTokenReturnsHttpNotFound()
+            public delegate Task<ActionResult> InvokeOwnershipRequest(PackagesController packagesController, string id, string username, string token);
+
+            private static Task<ActionResult> ConfirmOwnershipRequest(PackagesController packagesController, string id, string username, string token)
+            {
+                return packagesController.ConfirmPendingOwnershipRequest(id, username, token);
+            }
+
+            private static Task<ActionResult> RejectOwnershipRequest(PackagesController packagesController, string id, string username, string token)
+            {
+                return packagesController.RejectPendingOwnershipRequest(id, username, token);
+            }
+
+            public static IEnumerable<object[]> TheOwnershipRequestMethods_Data
+            {
+                get
+                {
+                    yield return new object[] { new InvokeOwnershipRequest(ConfirmOwnershipRequest) };
+                    yield return new object[] { new InvokeOwnershipRequest(RejectOwnershipRequest) };
+                }
+            }
+
+            [Theory]
+            [MemberData("TheOwnershipRequestMethods_Data")]
+            public async Task WithEmptyTokenReturnsHttpNotFound(InvokeOwnershipRequest invokeOwnershipRequest)
             {
+                // Arrange
                 var packageService = new Mock<IPackageService>();
                 packageService.Setup(p => p.FindPackageRegistrationById("foo")).Returns(new PackageRegistration());
                 var controller = CreateController(
@@ -595,39 +627,48 @@ public async Task WithEmptyTokenReturnsHttpNotFound()
                     packageService: packageService);
                 controller.SetCurrentUser(new User { Username = "username" });
 
-                var result = await controller.ConfirmOwner("foo", "username", "");
+                // Act
+                var result = await invokeOwnershipRequest(controller, "foo", "username", "");
 
+                // Assert
                 Assert.IsType<HttpNotFoundResult>(result);
             }
 
-            [Fact]
-            public async Task WithIdentityNotMatchingUserInRequestReturnsViewWithMessage()
+            [Theory]
+            [MemberData("TheOwnershipRequestMethods_Data")]
+            public async Task WithIdentityNotMatchingUserInRequestReturnsViewWithMessage(InvokeOwnershipRequest invokeOwnershipRequest)
             {
+                // Arrange
                 var controller = CreateController(GetConfigurationService());
                 controller.SetCurrentUser(new User("userA"));
-                var result = await controller.ConfirmOwner("foo", "userB", "token");
 
-                var model = ResultAssert.IsView<PackageOwnerConfirmationModel>(result);
+                // Act
+                var result = await invokeOwnershipRequest(controller, "foo", "userB", "token");
+
+                // Assert
+                var model = ResultAssert.IsView<PackageOwnerConfirmationModel>(result, "ConfirmOwner");
                 Assert.Equal(ConfirmOwnershipResult.NotYourRequest, model.Result);
                 Assert.Equal("userB", model.Username);
             }
 
-            [Fact]
-            public async Task WithNonExistentPackageIdReturnsHttpNotFound()
+            [Theory]
+            [MemberData("TheOwnershipRequestMethods_Data")]
+            public async Task WithNonExistentPackageIdReturnsHttpNotFound(InvokeOwnershipRequest invokeOwnershipRequest)
             {
                 // Arrange
                 var controller = CreateController(GetConfigurationService());
                 controller.SetCurrentUser(new User { Username = "username" });
 
                 // Act
-                var result = await controller.ConfirmOwner("foo", "username", "token");
+                var result = await invokeOwnershipRequest(controller, "foo", "username", "token");
 
                 // Assert
                 Assert.IsType<HttpNotFoundResult>(result);
             }
 
-            [Fact]
-            public async Task WithOwnerReturnsAlreadyOwnerResult()
+            [Theory]
+            [MemberData("TheOwnershipRequestMethods_Data")]
+            public async Task WithOwnerReturnsAlreadyOwnerResult(InvokeOwnershipRequest invokeOwnershipRequest)
             {
                 // Arrange
                 var package = new PackageRegistration { Id = "foo" };
@@ -644,43 +685,249 @@ public async Task WithOwnerReturnsAlreadyOwnerResult()
                 TestUtility.SetupHttpContextMockForUrlGeneration(mockHttpContext, controller);
 
                 // Act
-                var result = await controller.ConfirmOwner("foo", "username", "token");
+                var result = await invokeOwnershipRequest(controller, "foo", "username", "token");
 
                 // Assert
-                var model = ResultAssert.IsView<PackageOwnerConfirmationModel>(result);
+                var model = ResultAssert.IsView<PackageOwnerConfirmationModel>(result, "ConfirmOwner");
                 Assert.Equal(ConfirmOwnershipResult.AlreadyOwner, model.Result);
             }
 
+            public delegate Expression<Func<IPackageService, Task>> PackageServiceForOwnershipRequestExpression(PackageRegistration package, User user);
+
+            private static Expression<Func<IPackageService, Task>> PackagesServiceForConfirmOwnershipRequestExpression(PackageRegistration package, User user)
+            {
+                return packageService => packageService.AddPackageOwnerAsync(package, user);
+            }
+
+            private static Expression<Func<IPackageService, Task>> PackagesServiceForRejectOwnershipRequestExpression(PackageRegistration package, User user)
+            {
+                return packageService => packageService.RemovePackageOwnerAsync(package, user);
+            }
+
+            public delegate Expression<Action<IMessageService>> MessageServiceForOwnershipRequestExpression(PackageOwnerRequest request);
+
+            private static Expression<Action<IMessageService>> MessageServiceForConfirmOwnershipRequestExpression(PackageOwnerRequest request)
+            {
+                return messageService => messageService.SendPackageOwnerAddedNotice(
+                    request.RequestingOwner,
+                    request.NewOwner,
+                    request.PackageRegistration,
+                    It.IsAny<string>(), // The method that creates this URL correctly is not set up for these tests, so we cannot assert the expected value.
+                    string.Empty);
+            }
+
+            private static Expression<Action<IMessageService>> MessageServiceForRejectOwnershipRequestExpression(PackageOwnerRequest request)
+            {
+                return messageService => messageService.SendPackageOwnerRequestRejectionNotice(request.RequestingOwner, request.NewOwner, request.PackageRegistration);
+            }
+
+            public static IEnumerable<object[]> ReturnsSuccessIfTokenIsValid_Data
+            {
+                get
+                {
+                    foreach (var tokenValid in new bool[] { true, false })
+                    {
+                        yield return new object[]
+                        {
+                            new InvokeOwnershipRequest(ConfirmOwnershipRequest),
+                            new PackageServiceForOwnershipRequestExpression(PackagesServiceForConfirmOwnershipRequestExpression),
+                            new MessageServiceForOwnershipRequestExpression(MessageServiceForConfirmOwnershipRequestExpression),
+                            ConfirmOwnershipResult.Success,
+                            tokenValid
+                        };
+                        yield return new object[]
+                        {
+                            new InvokeOwnershipRequest(RejectOwnershipRequest),
+                            new PackageServiceForOwnershipRequestExpression(PackagesServiceForRejectOwnershipRequestExpression),
+                            new MessageServiceForOwnershipRequestExpression(MessageServiceForRejectOwnershipRequestExpression),
+                            ConfirmOwnershipResult.Rejected,
+                            tokenValid
+                        };
+                    }
+                }
+            }
+
             [Theory]
-            [InlineData(true)]
-            [InlineData(false)]
-            public async Task ReturnsSuccessIfTokenIsValid(bool tokenValid)
+            [MemberData("ReturnsSuccessIfTokenIsValid_Data")]
+            public async Task ReturnsSuccessIfTokenIsValid(InvokeOwnershipRequest invokeOwnershipRequest, PackageServiceForOwnershipRequestExpression packageServiceExpression, MessageServiceForOwnershipRequestExpression messageServiceExpression, ConfirmOwnershipResult successState, bool tokenValid)
             {
                 // Arrange
-                var package = new PackageRegistration { Id = "foo" };
-                var user = new User { Username = "username" };
+                var owner = new User { Key = 1, Username = "owner" };
+                var package = new PackageRegistration { Id = "foo", Owners = new[] { owner } };
+                var user = new User { Key = 2, Username = "username" };
+
                 var mockHttpContext = new Mock<HttpContextBase>();
+
                 var packageService = new Mock<IPackageService>();
                 packageService.Setup(p => p.FindPackageRegistrationById("foo")).Returns(package);
-                packageService.Setup(p => p.IsValidPackageOwnerRequest(package, user, "token"))
-                    .Returns(tokenValid);
                 packageService.Setup(p => p.AddPackageOwnerAsync(package, user)).Returns(Task.CompletedTask).Verifiable();
+
+                var packageOwnerRequestService = new Mock<IPackageOwnerRequestService>();
+                var request = new PackageOwnerRequest
+                {
+                    PackageRegistration = package,
+                    RequestingOwner = owner,
+                    NewOwner = user,
+                    ConfirmationCode = "token"
+                };
+                packageOwnerRequestService.Setup(p => p.GetPackageOwnershipRequest(package, user, "token"))
+                    .Returns(tokenValid ? request : null);
+
+                var messageService = new Mock<IMessageService>();
+
                 var controller = CreateController(
                     GetConfigurationService(),
                     httpContext: mockHttpContext,
-                    packageService: packageService);
+                    packageService: packageService,
+                    packageOwnerRequestService: packageOwnerRequestService,
+                    messageService: messageService);
                 controller.SetCurrentUser(user);
                 TestUtility.SetupHttpContextMockForUrlGeneration(mockHttpContext, controller);
 
                 // Act
-                var result = await controller.ConfirmOwner("foo", "username", "token");
+                var result = await invokeOwnershipRequest(controller, "foo", "username", "token");
 
                 // Assert
-                var model = ResultAssert.IsView<PackageOwnerConfirmationModel>(result);
-                var expectedResult = tokenValid ? ConfirmOwnershipResult.Success : ConfirmOwnershipResult.Failure;
+                var model = ResultAssert.IsView<PackageOwnerConfirmationModel>(result, "ConfirmOwner");
+                var expectedResult = tokenValid ? successState : ConfirmOwnershipResult.Failure;
                 Assert.Equal(expectedResult, model.Result);
                 Assert.Equal("foo", model.PackageId);
-                packageService.Verify(p => p.AddPackageOwnerAsync(package, user), tokenValid ? Times.Once() : Times.Never());
+                packageService.Verify(packageServiceExpression(package, user), tokenValid ? Times.Once() : Times.Never());
+                messageService.Verify(messageServiceExpression(request), tokenValid ? Times.Once() : Times.Never());
+            }
+
+            public class TheCancelPendingOwnershipRequestMethod : TestContainer
+            {
+                [Fact]
+                public async Task WithIdentityNotMatchingUserInRequestReturnsViewWithMessage()
+                {
+                    // Arrange
+                    var controller = CreateController(GetConfigurationService());
+                    controller.SetCurrentUser(new User("userA"));
+
+                    // Act
+                    var result = await controller.CancelPendingOwnershipRequest("foo", "userB", "userC");
+
+                    // Assert
+                    var model = ResultAssert.IsView<PackageOwnerConfirmationModel>(result, "ConfirmOwner");
+                    Assert.Equal(ConfirmOwnershipResult.NotYourRequest, model.Result);
+                    Assert.Equal("userB", model.Username);
+                }
+
+                [Fact]
+                public async Task WithNonExistentPackageIdReturnsHttpNotFound()
+                {
+                    // Arrange
+                    var controller = CreateController(GetConfigurationService());
+                    controller.SetCurrentUser(new User { Username = "userA" });
+
+                    // Act
+                    var result = await controller.CancelPendingOwnershipRequest("foo", "userA", "userB");
+
+                    // Assert
+                    Assert.IsType<HttpNotFoundResult>(result);
+                }
+
+                [Fact]
+                public async Task WithNonExistentPendingUserReturnsHttpNotFound()
+                {
+                    // Arrange
+                    var package = new PackageRegistration { Id = "foo" };
+                    var user = new User { Username = "userA" };
+                    var packageService = new Mock<IPackageService>();
+                    packageService.Setup(p => p.FindPackageRegistrationById("foo")).Returns(package);
+                    var controller = CreateController(
+                        GetConfigurationService(),
+                        packageService: packageService);
+                    controller.SetCurrentUser(user);
+
+                    // Act
+                    var result = await controller.CancelPendingOwnershipRequest("foo", "userA", "userB");
+
+                    // Assert
+                    Assert.IsType<HttpNotFoundResult>(result);
+                }
+
+                [Fact]
+                public async Task WithNonExistentPackageOwnershipRequestReturnsHttpNotFound()
+                {
+                    // Arrange
+                    var packageId = "foo";
+                    var package = new PackageRegistration { Id = packageId };
+
+                    var packageService = new Mock<IPackageService>();
+                    packageService.Setup(p => p.FindPackageRegistrationById(packageId)).Returns(package);
+
+                    var userAName = "userA";
+                    var userA = new User { Username = userAName };
+
+                    var userBName = "userB";
+                    var userB = new User { Username = userBName };
+
+                    var userService = new Mock<IUserService>();
+                    userService.Setup(u => u.FindByUsername(userAName)).Returns(userA);
+                    userService.Setup(u => u.FindByUsername(userBName)).Returns(userB);
+
+                    var controller = CreateController(
+                        GetConfigurationService(),
+                        userService: userService,
+                        packageService: packageService);
+                    controller.SetCurrentUser(userA);
+
+                    // Act
+                    var result = await controller.CancelPendingOwnershipRequest(packageId, userAName, userBName);
+
+                    // Assert
+                    Assert.IsType<HttpNotFoundResult>(result);
+                }
+
+                [Fact]
+                public async Task ReturnsCancelledIfPackageOwnershipRequestExists()
+                {
+                    // Arrange
+                    var packageId = "foo";
+                    var package = new PackageRegistration { Id = packageId };
+
+                    var packageService = new Mock<IPackageService>();
+                    packageService.Setup(p => p.FindPackageRegistrationById(packageId)).Returns(package);
+
+                    var userAName = "userA";
+                    var userA = new User { Username = userAName };
+
+                    var userBName = "userB";
+                    var userB = new User { Username = userBName };
+
+                    var userService = new Mock<IUserService>();
+                    userService.Setup(u => u.FindByUsername(userAName)).Returns(userA);
+                    userService.Setup(u => u.FindByUsername(userBName)).Returns(userB);
+
+                    var request = new PackageOwnerRequest() { RequestingOwner = userA, NewOwner = userB };
+                    var packageOwnerRequestService = new Mock<IPackageOwnerRequestService>();
+                    packageOwnerRequestService.Setup(p => p.GetPackageOwnershipRequests(package, userA, userB)).Returns(new[] { request });
+                    packageOwnerRequestService.Setup(p => p.DeletePackageOwnershipRequest(request)).Returns(Task.CompletedTask).Verifiable();
+
+                    var messageService = new Mock<IMessageService>();
+
+                    var controller = CreateController(
+                        GetConfigurationService(),
+                        userService: userService,
+                        packageService: packageService,
+                        packageOwnerRequestService: packageOwnerRequestService,
+                        messageService: messageService);
+                    controller.SetCurrentUser(userA);
+
+                    // Act
+                    var result = await controller.CancelPendingOwnershipRequest(packageId, userAName, userBName);
+
+                    // Assert
+                    var model = ResultAssert.IsView<PackageOwnerConfirmationModel>(result, "ConfirmOwner");
+                    var expectedResult = ConfirmOwnershipResult.Cancelled;
+                    Assert.Equal(expectedResult, model.Result);
+                    Assert.Equal(packageId, model.PackageId);
+                    packageService.Verify();
+                    packageOwnerRequestService.Verify();
+                    messageService.Verify(m => m.SendPackageOwnerRequestCancellationNotice(userA, userB, package));
+                }
             }
 
             public class TheConfirmOwnerMethod_SecurePushPropagation : TestContainer
@@ -737,7 +984,15 @@ private async Task<IDictionary<string, string>> AssertConfirmOwnerSubscribesUser
 
                     var packageService = new Mock<IPackageService>();
                     packageService.Setup(p => p.FindPackageRegistrationById(It.IsAny<string>())).Returns(fakes.Package);
-                    packageService.Setup(p => p.IsValidPackageOwnerRequest(fakes.Package, fakes.User, "token")).Returns(true);
+
+                    var packageOwnerRequestService = new Mock<IPackageOwnerRequestService>();
+                    packageOwnerRequestService.Setup(p => p.GetPackageOwnershipRequest(fakes.Package, fakes.User, "token")).Returns(
+                        new PackageOwnerRequest
+                        {
+                            PackageRegistration = fakes.Package,
+                            NewOwner = fakes.User,
+                            ConfirmationCode = "token"
+                        });
 
                     var policyService = new Mock<ISecurityPolicyService>();
                     foreach (var user in usersSubscribed)
@@ -760,6 +1015,7 @@ private async Task<IDictionary<string, string>> AssertConfirmOwnerSubscribesUser
                         GetConfigurationService(),
                         httpContext: mockHttpContext,
                         packageService: packageService,
+                        packageOwnerRequestService: packageOwnerRequestService,
                         messageService: messageService,
                         securityPolicyService: policyService);
 
@@ -767,7 +1023,7 @@ private async Task<IDictionary<string, string>> AssertConfirmOwnerSubscribesUser
                     TestUtility.SetupHttpContextMockForUrlGeneration(mockHttpContext, controller);
 
                     // Act
-                    await controller.ConfirmOwner(fakes.Package.Id, fakes.User.Username, "token");
+                    await controller.ConfirmPendingOwnershipRequest(fakes.Package.Id, fakes.User.Username, "token");
 
                     // Assert
                     foreach (var user in usersSubscribed)
diff --git a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
index a06f0642ea..0e10b1d710 100644
--- a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
+++ b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
@@ -411,6 +411,7 @@
     <Compile Include="Controllers\UsersControllerFacts.cs" />
     <Compile Include="Framework\TestGalleryConfigurationService.cs" />
     <Compile Include="Helpers\HtmlExtensionsFacts.cs" />
+    <Compile Include="Services\PackageOwnerRequestServiceFacts.cs" />
     <Compile Include="Services\ReadMeServiceFacts.cs" />
     <Compile Include="Infrastructure\UserAuditRecordFacts.cs" />
     <Compile Include="OData\Filter\ODataFilterFacts.cs" />
diff --git a/tests/NuGetGallery.Facts/Services/MessageServiceFacts.cs b/tests/NuGetGallery.Facts/Services/MessageServiceFacts.cs
index 1840936f3b..70dc554d9a 100644
--- a/tests/NuGetGallery.Facts/Services/MessageServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/MessageServiceFacts.cs
@@ -363,12 +363,13 @@ public void SendsPackageOwnerRequestConfirmationUrl()
                 var package = new PackageRegistration { Id = "CoolStuff" };
                 const string packageUrl = "http://nuget.local/packages/CoolStuff";
                 const string confirmationUrl = "http://example.com/confirmation-token-url";
+                const string rejectionUrl = "http://example.com/rejection-token-url";
                 const string userMessage = "Hello World!";
 
                 var messageService = TestableMessageService.Create(
                     GetService<AuthenticationService>(),
                     GetConfigurationService());
-                messageService.SendPackageOwnerRequest(from, to, package, packageUrl, confirmationUrl, userMessage, string.Empty);
+                messageService.SendPackageOwnerRequest(from, to, package, packageUrl, confirmationUrl, rejectionUrl, userMessage, string.Empty);
                 var message = messageService.MockMailSender.Sent.Last();
 
                 Assert.Equal("new-owner@example.com", message.To[0].Address);
@@ -390,11 +391,12 @@ public void SendsPackageOwnerRequestConfirmationUrlWithoutUserMessage()
                 var package = new PackageRegistration { Id = "CoolStuff" };
                 const string packageUrl = "http://nuget.local/packages/CoolStuff";
                 const string confirmationUrl = "http://example.com/confirmation-token-url";
+                const string rejectionUrl = "http://example.com/rejection-token-url";
 
                 var messageService = TestableMessageService.Create(
                     GetService<AuthenticationService>(),
                     GetConfigurationService());
-                messageService.SendPackageOwnerRequest(from, to, package, packageUrl, confirmationUrl, string.Empty, string.Empty);
+                messageService.SendPackageOwnerRequest(from, to, package, packageUrl, confirmationUrl, rejectionUrl, string.Empty, string.Empty);
                 var message = messageService.MockMailSender.Sent.Last();
 
                 Assert.DoesNotContain("The user 'Existing' added the following message for you", message.Body);
@@ -408,11 +410,111 @@ public void DoesNotSendRequestIfUserDoesNotAllowEmails()
                 var package = new PackageRegistration { Id = "CoolStuff" };
                 const string packageUrl = "http://nuget.local/packages/CoolStuff";
                 const string confirmationUrl = "http://example.com/confirmation-token-url";
+                const string rejectionUrl = "http://example.com/rejection-token-url";
 
                 var messageService = TestableMessageService.Create(
                     GetService<AuthenticationService>(),
                     GetConfigurationService());
-                messageService.SendPackageOwnerRequest(from, to, package, packageUrl, confirmationUrl, string.Empty, string.Empty);
+                messageService.SendPackageOwnerRequest(from, to, package, packageUrl, confirmationUrl, rejectionUrl, string.Empty, string.Empty);
+
+                Assert.Empty(messageService.MockMailSender.Sent);
+            }
+        }
+
+        public class TheSendPackageOwnerRequestRejectionNoticeMethod
+            : TestContainer
+        {
+            [Fact]
+            public void SendsNotice()
+            {
+                var requestingOwner = new User { Username = "Existing", EmailAddress = "existing-owner@example.com", EmailAllowed = true };
+                var newOwner = new User { Username = "Noob", EmailAddress = "new-owner@example.com" };
+                var package = new PackageRegistration { Id = "CoolStuff" };
+
+                var request = new PackageOwnerRequest
+                {
+                    PackageRegistration = package,
+                    RequestingOwner = requestingOwner,
+                    NewOwner = newOwner
+                };
+
+                var messageService = TestableMessageService.Create(
+                    GetService<AuthenticationService>(),
+                    GetConfigurationService());
+                messageService.SendPackageOwnerRequestRejectionNotice(requestingOwner, newOwner, package);
+                var message = messageService.MockMailSender.Sent.Last();
+
+                Assert.Equal(requestingOwner.EmailAddress, message.To[0].Address);
+                Assert.Equal(TestGalleryNoReplyAddress.Address, message.From.Address);
+                Assert.Equal(newOwner.EmailAddress, message.ReplyToList.Single().Address);
+                Assert.Equal("[Joe Shmoe] The user 'Noob' has rejected your request to add them as an owner of the package 'CoolStuff'.", message.Subject);
+                Assert.Contains("The user 'Noob' has rejected your request to add them as an owner of the package 'CoolStuff'.", message.Body);
+            }
+
+            [Fact]
+            public void DoesNotSendNoticeIfUserDoesNotAllowEmails()
+            {
+                var requestingOwner = new User { Username = "Existing", EmailAddress = "existing-owner@example.com" };
+                var newOwner = new User { Username = "Noob", EmailAddress = "new-owner@example.com" };
+                var package = new PackageRegistration { Id = "CoolStuff" };
+
+                var request = new PackageOwnerRequest
+                {
+                    PackageRegistration = package,
+                    RequestingOwner = requestingOwner,
+                    NewOwner = newOwner
+                };
+
+                var messageService = TestableMessageService.Create(
+                    GetService<AuthenticationService>(),
+                    GetConfigurationService());
+                messageService.SendPackageOwnerRequestRejectionNotice(requestingOwner, newOwner, package);
+
+                Assert.Empty(messageService.MockMailSender.Sent);
+            }
+        }
+
+        public class TheSendPackageOwnerRequestCancellationNoticeMethod
+            : TestContainer
+        {
+            [Fact]
+            public void SendsNotice()
+            {
+                var requestingOwner = new User { Username = "Existing", EmailAddress = "existing-owner@example.com" };
+                var newOwner = new User { Username = "Noob", EmailAddress = "new-owner@example.com", EmailAllowed = true };
+                var package = new PackageRegistration { Id = "CoolStuff" };
+
+                var messageService = TestableMessageService.Create(
+                    GetService<AuthenticationService>(),
+                    GetConfigurationService());
+                messageService.SendPackageOwnerRequestCancellationNotice(requestingOwner, newOwner, package);
+                var message = messageService.MockMailSender.Sent.Last();
+
+                Assert.Equal(newOwner.EmailAddress, message.To[0].Address);
+                Assert.Equal(TestGalleryNoReplyAddress.Address, message.From.Address);
+                Assert.Equal(requestingOwner.EmailAddress, message.ReplyToList.Single().Address);
+                Assert.Equal("[Joe Shmoe] The user 'Existing' has cancelled their request for you to be added as an owner of the package 'CoolStuff'.", message.Subject);
+                Assert.Contains("The user 'Existing' has cancelled their request for you to be added as an owner of the package 'CoolStuff'.", message.Body);
+            }
+
+            [Fact]
+            public void DoesNotSendNoticeIfUserDoesNotAllowEmails()
+            {
+                var requestingOwner = new User { Username = "Existing", EmailAddress = "existing-owner@example.com" };
+                var newOwner = new User { Username = "Noob", EmailAddress = "new-owner@example.com" };
+                var package = new PackageRegistration { Id = "CoolStuff" };
+
+                var request = new PackageOwnerRequest
+                {
+                    PackageRegistration = package,
+                    RequestingOwner = requestingOwner,
+                    NewOwner = newOwner
+                };
+
+                var messageService = TestableMessageService.Create(
+                    GetService<AuthenticationService>(),
+                    GetConfigurationService());
+                messageService.SendPackageOwnerRequestCancellationNotice(requestingOwner, newOwner, package);
 
                 Assert.Empty(messageService.MockMailSender.Sent);
             }
diff --git a/tests/NuGetGallery.Facts/Services/PackageOwnerRequestServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageOwnerRequestServiceFacts.cs
new file mode 100644
index 0000000000..a4bc574262
--- /dev/null
+++ b/tests/NuGetGallery.Facts/Services/PackageOwnerRequestServiceFacts.cs
@@ -0,0 +1,145 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Moq;
+using Xunit;
+
+namespace NuGetGallery.Services
+{
+    public class PackageOwnerRequestServiceFacts
+    {
+        public class TheIsValidPackageOwnerRequestMethod
+        {
+            [Fact]
+            public void ThrowsArgumentNullIfPackageIsNull()
+            {
+                Assert.Throws<ArgumentNullException>(() => CreateService().GetPackageOwnershipRequest(null, new User(), "token"));
+            }
+
+            [Fact]
+            public void ThrowsArgumentNullIfPendingOwnerIsNull()
+            {
+                Assert.Throws<ArgumentNullException>(() => CreateService().GetPackageOwnershipRequest(new PackageRegistration(), null, "token"));
+            }
+
+            [Theory]
+            [InlineData("")]
+            [InlineData(null)]
+            public void ThrowsArgumentNullIfTokenIsNullOrEmpty(string token)
+            {
+                Assert.Throws<ArgumentNullException>(() => CreateService().GetPackageOwnershipRequest(new PackageRegistration(), new User(), token));
+            }
+
+            [Theory]
+            [InlineData(1, 2, "token", true)]
+            [InlineData(2, 2, "token", false)]
+            [InlineData(1, 1, "token", false)]
+            [InlineData(1, 2, "token2", false)]
+            private void ReturnsSuccessIfPackageOwnerRequestMatches(int packageId, int userId, string token, bool success)
+            {
+                // Arrange
+                const int actualKey = 1;
+                const int actualNewOwner = 2;
+                const string actualToken = "token";
+
+                var package = new PackageRegistration { Key = packageId };
+                var pendingOwner = new User { Key = userId };
+
+                var repository = new Mock<IEntityRepository<PackageOwnerRequest>>();
+                repository.Setup(r => r.GetAll()).Returns(
+                    new[] 
+                    {
+                        new PackageOwnerRequest
+                        {
+                            PackageRegistration = new PackageRegistration { Key = actualKey },
+                            PackageRegistrationKey = actualKey,
+
+                            NewOwner = new User { Key = actualNewOwner },
+                            NewOwnerKey = actualNewOwner,
+
+                            ConfirmationCode = actualToken
+                        }
+                    }
+                    .AsQueryable());
+                var service = CreateService(packageOwnerRequestRepo: repository);
+
+                // Act
+                var request = service.GetPackageOwnershipRequest(package, pendingOwner, token);
+
+                // Assert
+                if (success)
+                {
+                    Assert.NotNull(request);
+                }
+                else
+                {
+                    Assert.Null(request);
+                }
+            }
+        }
+
+        public class TheAddPackageOwnershipRequestMethod
+        {
+            [Fact]
+            public async Task CreatesPackageOwnerRequest()
+            {
+                var packageOwnerRequestRepository = new Mock<IEntityRepository<PackageOwnerRequest>>();
+                var service = CreateService(packageOwnerRequestRepo: packageOwnerRequestRepository);
+                var package = new PackageRegistration { Key = 1 };
+                var owner = new User { Key = 100 };
+                var newOwner = new User { Key = 200 };
+
+                await service.AddPackageOwnershipRequest(package, owner, newOwner);
+
+                packageOwnerRequestRepository.Verify(
+                    r => r.InsertOnCommit(
+                        It.Is<PackageOwnerRequest>(req => req.PackageRegistrationKey == 1 && req.RequestingOwnerKey == 100 && req.NewOwnerKey == 200))
+                    );
+            }
+
+            [Fact]
+            public async Task ReturnsExistingMatchingPackageOwnerRequest()
+            {
+                // Arrange
+                var package = new PackageRegistration { Key = 1 };
+                var existingRequestingOwner = new User { Key = 100 };
+                var newRequestingOwner = new User { Key = 99 };
+                var newOwner = new User { Key = 200 };
+
+                var packageOwnerRequestRepository = new Mock<IEntityRepository<PackageOwnerRequest>>();
+                packageOwnerRequestRepository.Setup(r => r.GetAll()).Returns(
+                    new[]
+                    {
+                        new PackageOwnerRequest
+                        {
+                            PackageRegistration = package,
+                            PackageRegistrationKey = package.Key,
+
+                            RequestingOwner = existingRequestingOwner,
+                            RequestingOwnerKey = existingRequestingOwner.Key,
+
+                            NewOwner = newOwner,
+                            NewOwnerKey = newOwner.Key
+                        }
+                    }.AsQueryable());
+                var service = CreateService(packageOwnerRequestRepo: packageOwnerRequestRepository);
+
+                // Act
+                var request = await service.AddPackageOwnershipRequest(package, newRequestingOwner, newOwner);
+
+                // Assert
+                Assert.Equal(existingRequestingOwner.Key, request.RequestingOwnerKey);
+            }
+        }
+
+        private static IPackageOwnerRequestService CreateService(Mock<IEntityRepository<PackageOwnerRequest>> packageOwnerRequestRepo = null)
+        {
+            packageOwnerRequestRepo = packageOwnerRequestRepo ?? new Mock<IEntityRepository<PackageOwnerRequest>>();
+
+            return new PackageOwnerRequestService(packageOwnerRequestRepo.Object);
+        }
+    }
+}
diff --git a/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
index b464544b79..26f6d2badf 100644
--- a/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
@@ -22,7 +22,7 @@ public class PackageServiceFacts
         private static IPackageService CreateService(
             Mock<IEntityRepository<PackageRegistration>> packageRegistrationRepository = null,
             Mock<IEntityRepository<Package>> packageRepository = null,
-            Mock<IEntityRepository<PackageOwnerRequest>> packageOwnerRequestRepo = null,
+            Mock<IPackageOwnerRequestService> packageOwnerRequestService = null,
             Mock<IIndexingService> indexingService = null,
             IPackageNamingConflictValidator packageNamingConflictValidator = null,
             IAuditingService auditingService = null,
@@ -30,7 +30,7 @@ private static IPackageService CreateService(
         {
             packageRegistrationRepository = packageRegistrationRepository ?? new Mock<IEntityRepository<PackageRegistration>>();
             packageRepository = packageRepository ?? new Mock<IEntityRepository<Package>>();
-            packageOwnerRequestRepo = packageOwnerRequestRepo ?? new Mock<IEntityRepository<PackageOwnerRequest>>();
+            packageOwnerRequestService = packageOwnerRequestService ?? new Mock<IPackageOwnerRequestService>();
             indexingService = indexingService ?? new Mock<IIndexingService>();
             auditingService = auditingService ?? new TestAuditingService();
 
@@ -44,7 +44,7 @@ private static IPackageService CreateService(
             var packageService = new Mock<PackageService>(
                 packageRegistrationRepository.Object,
                 packageRepository.Object,
-                packageOwnerRequestRepo.Object,
+                packageOwnerRequestService.Object,
                 indexingService.Object,
                 packageNamingConflictValidator,
                 auditingService);
@@ -83,21 +83,16 @@ public async Task RemovesRelatedPendingOwnerRequest()
                 var packageOwnerRequest = new PackageOwnerRequest { PackageRegistrationKey = 2, NewOwnerKey = 100, ConfirmationCode = "secret-token" };
                 var package = new PackageRegistration { Key = 2, Id = "pkg42" };
                 var pendingOwner = new User { Key = 100, Username = "teamawesome" };
-                var repository = new Mock<IEntityRepository<PackageOwnerRequest>>();
-                repository.Setup(r => r.DeleteOnCommit(packageOwnerRequest)).Verifiable();
-                repository.Setup(r => r.CommitChangesAsync())
+                var packageOwnerRequestService = new Mock<IPackageOwnerRequestService>();
+                packageOwnerRequestService.Setup(p => p.DeletePackageOwnershipRequest(packageOwnerRequest))
                     .Returns(Task.CompletedTask).Verifiable();
-                repository.Setup(r => r.GetAll()).Returns(
-                    new[]
-                        {
-                            new PackageOwnerRequest { PackageRegistrationKey = 1, NewOwnerKey = 100, ConfirmationCode = "super-secret-token" },
-                            packageOwnerRequest
-                        }.AsQueryable());
-                var service = CreateService(packageOwnerRequestRepo: repository);
+                packageOwnerRequestService.Setup(p => p.GetPackageOwnershipRequests(package, null, pendingOwner))
+                    .Returns(new[] { packageOwnerRequest }).Verifiable();
+                var service = CreateService(packageOwnerRequestService: packageOwnerRequestService);
 
                 await service.AddPackageOwnerAsync(package, pendingOwner);
 
-                repository.VerifyAll();
+                packageOwnerRequestService.VerifyAll();
             }
 
             [Fact]
@@ -122,49 +117,6 @@ public async Task WritesAnAuditRecord()
             }
         }
 
-        public class TheIsValidPackageOwnerRequestMethod
-        {
-            [Fact]
-            public void ThrowsArgumentNullIfPackageIsNull()
-            {
-                Assert.Throws<ArgumentNullException>(() => CreateService().IsValidPackageOwnerRequest(null, new User(), "token"));
-            }
-
-            [Fact]
-            public void ThrowsArgumentNullIfPendingOwnerIsNull()
-            {
-                Assert.Throws<ArgumentNullException>(() => CreateService().IsValidPackageOwnerRequest(new PackageRegistration(), null, "token"));
-            }
-
-            [Theory]
-            [InlineData("")]
-            [InlineData(null)]
-            public void ThrowsArgumentNullIfTokenIsNullOrEmpty(string token)
-            {
-                Assert.Throws<ArgumentNullException>(() => CreateService().IsValidPackageOwnerRequest(new PackageRegistration(), new User(), token));
-            }
-
-            [Theory]
-            [InlineData(1, 2, "token", true)]
-            [InlineData(2, 2, "token", false)]
-            [InlineData(1, 1, "token", false)]
-            [InlineData(1, 2, "token2", false)]
-            private void ReturnsSuccessIfPackageOwnerRequestMatches(int packageId, int userId, string token, bool success)
-            {
-                // Arrange
-                var repository = new Mock<IEntityRepository<PackageOwnerRequest>>();
-                repository.Setup(r => r.GetAll()).Returns(
-                    new[] { new PackageOwnerRequest { PackageRegistrationKey = 1, NewOwnerKey = 2, ConfirmationCode = "token" } }
-                    .AsQueryable());
-                var service = CreateService(packageOwnerRequestRepo: repository);
-                var package = new PackageRegistration { Key = packageId, Id = "pkg42" };
-                var pendingOwner = new User { Key = userId, Username = "teamawesome" };
-
-                // Act & Assert
-                Assert.Equal(success, service.IsValidPackageOwnerRequest(package, pendingOwner, token));
-            }
-        }
-
         public class TheCreatePackageMethod
         {
             [Fact]
@@ -843,50 +795,6 @@ private async Task WillNotSaveAnySupportedFrameworksWhenThereIsAnAnyTargetFramew
             }
         }
 
-        public class TheCreatePackageOwnerRequestMethod
-        {
-            [Fact]
-            public async Task CreatesPackageOwnerRequest()
-            {
-                var packageOwnerRequestRepository = new Mock<IEntityRepository<PackageOwnerRequest>>();
-                var service = CreateService(packageOwnerRequestRepo: packageOwnerRequestRepository);
-                var package = new PackageRegistration { Key = 1 };
-                var owner = new User { Key = 100 };
-                var newOwner = new User { Key = 200 };
-
-                await service.CreatePackageOwnerRequestAsync(package, owner, newOwner);
-
-                packageOwnerRequestRepository.Verify(
-                    r => r.InsertOnCommit(
-                        It.Is<PackageOwnerRequest>(req => req.PackageRegistrationKey == 1 && req.RequestingOwnerKey == 100 && req.NewOwnerKey == 200))
-                    );
-            }
-
-            [Fact]
-            public async Task ReturnsExistingMatchingPackageOwnerRequest()
-            {
-                var packageOwnerRequestRepository = new Mock<IEntityRepository<PackageOwnerRequest>>();
-                packageOwnerRequestRepository.Setup(r => r.GetAll()).Returns(
-                    new[]
-                        {
-                            new PackageOwnerRequest
-                                {
-                                    PackageRegistrationKey = 1,
-                                    RequestingOwnerKey = 99,
-                                    NewOwnerKey = 200
-                                }
-                        }.AsQueryable());
-                var service = CreateService(packageOwnerRequestRepo: packageOwnerRequestRepository);
-                var package = new PackageRegistration { Key = 1 };
-                var owner = new User { Key = 100 };
-                var newOwner = new User { Key = 200 };
-
-                var request = await service.CreatePackageOwnerRequestAsync(package, owner, newOwner);
-
-                Assert.Equal(99, request.RequestingOwnerKey);
-            }
-        }
-
         public class TheFindPackageByIdAndVersionMethod
         {
             [Fact]
@@ -1813,26 +1721,31 @@ await Assert.ThrowsAsync<InvalidOperationException>(
             [Fact]
             public async Task RemovesPendingPackageOwner()
             {
+                var pendingOwner = new User { Key = 200 };
+                var owner = new User() { Key = 99 };
+                var package = new PackageRegistration { Key = 1, Owners = new List<User> { owner } };
+
                 var packageOwnerRequest = new PackageOwnerRequest
                 {
-                    PackageRegistrationKey = 1,
-                    RequestingOwnerKey = 99,
-                    NewOwnerKey = 200
+                    PackageRegistration = package,
+                    PackageRegistrationKey = package.Key,
+
+                    RequestingOwner = owner,
+                    RequestingOwnerKey = owner.Key,
+
+                    NewOwner = pendingOwner,
+                    NewOwnerKey = pendingOwner.Key,
                 };
-                var packageOwnerRequestRepository = new Mock<IEntityRepository<PackageOwnerRequest>>();
-                packageOwnerRequestRepository.Setup(r => r.GetAll()).Returns(new[] { packageOwnerRequest }.AsQueryable());
-                packageOwnerRequestRepository.Setup(r => r.DeleteOnCommit(packageOwnerRequest)).Verifiable();
-                packageOwnerRequestRepository.Setup(r => r.CommitChangesAsync())
-                    .Returns(Task.CompletedTask).Verifiable();
-                var service = CreateService(packageOwnerRequestRepo: packageOwnerRequestRepository);
-                var pendingOwner = new User { Key = 200 };
-                var owner = new User();
-                var package = new PackageRegistration { Key = 1, Owners = new List<User> { owner } };
+
+                var packageOwnerRequestService = new Mock<IPackageOwnerRequestService>();
+                packageOwnerRequestService.Setup(p => p.GetPackageOwnershipRequests(package, null, pendingOwner)).Returns(new[] { packageOwnerRequest });
+                packageOwnerRequestService.Setup(p => p.DeletePackageOwnershipRequest(packageOwnerRequest)).Returns(Task.CompletedTask).Verifiable();
+                var service = CreateService(packageOwnerRequestService: packageOwnerRequestService);
 
                 await service.RemovePackageOwnerAsync(package, pendingOwner);
 
                 Assert.Contains(owner, package.Owners);
-                packageOwnerRequestRepository.VerifyAll();
+                packageOwnerRequestService.VerifyAll();
             }
 
             [Fact]
diff --git a/tests/NuGetGallery.Facts/Services/ReflowPackageServiceFacts.cs b/tests/NuGetGallery.Facts/Services/ReflowPackageServiceFacts.cs
index cbdb09d675..b6e387e312 100644
--- a/tests/NuGetGallery.Facts/Services/ReflowPackageServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/ReflowPackageServiceFacts.cs
@@ -266,7 +266,7 @@ private static Mock<PackageService> SetupPackageService(Package package)
         {
             var packageRegistrationRepository = new Mock<IEntityRepository<PackageRegistration>>();
             var packageRepository = new Mock<IEntityRepository<Package>>();
-            var packageOwnerRequestRepo = new Mock<IEntityRepository<PackageOwnerRequest>>();
+            var packageOwnerRequestService = new Mock<IPackageOwnerRequestService>();
             var indexingService = new Mock<IIndexingService>();
             var packageNamingConflictValidator = new PackageNamingConflictValidator(
                     packageRegistrationRepository.Object,
@@ -276,7 +276,7 @@ private static Mock<PackageService> SetupPackageService(Package package)
             var packageService = new Mock<PackageService>(
                 packageRegistrationRepository.Object,
                 packageRepository.Object,
-                packageOwnerRequestRepo.Object,
+                packageOwnerRequestService.Object,
                 indexingService.Object,
                 packageNamingConflictValidator,
                 auditingService);
diff --git a/tests/NuGetGallery.Facts/TestUtils/TestServiceUtility.cs b/tests/NuGetGallery.Facts/TestUtils/TestServiceUtility.cs
index ee2801d326..6545e22234 100644
--- a/tests/NuGetGallery.Facts/TestUtils/TestServiceUtility.cs
+++ b/tests/NuGetGallery.Facts/TestUtils/TestServiceUtility.cs
@@ -268,7 +268,7 @@ private Mock<PackageService> SetupPackageService()
                 .Verifiable();
 
             var packageRepository = new Mock<IEntityRepository<Package>>();
-            var packageOwnerRequestRepo = new Mock<IEntityRepository<PackageOwnerRequest>>();
+            var packageOwnerRequestService = new Mock<IPackageOwnerRequestService>();
             var indexingService = new Mock<IIndexingService>();
             var packageNamingConflictValidator = new PackageNamingConflictValidator(
                     packageRegistrationRepository.Object,
@@ -278,7 +278,7 @@ private Mock<PackageService> SetupPackageService()
             var packageService = new Mock<PackageService>(
                 packageRegistrationRepository.Object,
                 packageRepository.Object,
-                packageOwnerRequestRepo.Object,
+                packageOwnerRequestService.Object,
                 indexingService.Object,
                 packageNamingConflictValidator,
                 auditingService);

From 0e025b456555bc3209be7c3ed55206526a66003a Mon Sep 17 00:00:00 2001
From: Svetlana Kofman <skofman@microsoft.com>
Date: Mon, 25 Sep 2017 15:36:11 -0700
Subject: [PATCH 08/25] Add support for X-NuGet-Protocol-Version header (#4740)

---
 src/NuGetGallery/Constants.cs                 |  3 +
 .../RequireMinClientVersionForPushPolicy.cs   | 26 +++++--
 src/NuGetGallery/Services/TelemetryService.cs |  8 +++
 .../ClientInformationTelemetryEnricher.cs     | 11 +--
 ...quireMinClientVersionForPushPolicyFacts.cs | 67 +++++++++++++++++--
 ...ClientInformationTelemetryEnricherTests.cs | 25 ++++++-
 6 files changed, 125 insertions(+), 15 deletions(-)

diff --git a/src/NuGetGallery/Constants.cs b/src/NuGetGallery/Constants.cs
index 09dd3428ea..0dc75f7a10 100644
--- a/src/NuGetGallery/Constants.cs
+++ b/src/NuGetGallery/Constants.cs
@@ -74,7 +74,10 @@ public static class Constants
         public const string UrlValidationErrorMessage = "This doesn't appear to be a valid HTTP/HTTPS URL";
 
         internal const string ApiKeyHeaderName = "X-NuGet-ApiKey";
+        // X-NuGet-Client-Version header was deprecated and replaced with X-NuGet-Protocol-Version header
+        // It stays here for backwards compatibility
         internal const string ClientVersionHeaderName = "X-NuGet-Client-Version";
+        internal const string NuGetProtocolHeaderName = "X-NuGet-Protocol-Version";
         internal const string WarningHeaderName = "X-NuGet-Warning";
         internal const string UserAgentHeaderName = "User-Agent";
 
diff --git a/src/NuGetGallery/Security/RequireMinClientVersionForPushPolicy.cs b/src/NuGetGallery/Security/RequireMinClientVersionForPushPolicy.cs
index 9f68cf5066..dab36ad9ed 100644
--- a/src/NuGetGallery/Security/RequireMinClientVersionForPushPolicy.cs
+++ b/src/NuGetGallery/Security/RequireMinClientVersionForPushPolicy.cs
@@ -7,7 +7,6 @@
 using Newtonsoft.Json;
 using NuGet.Protocol;
 using NuGet.Versioning;
-using NuGetGallery.Filters;
 
 namespace NuGetGallery.Security
 {
@@ -63,7 +62,18 @@ private NuGetVersion GetClientVersion(UserSecurityPolicyEvaluationContext contex
             NuGetVersion clientVersion;
             return NuGetVersion.TryParse(clientVersionString, out clientVersion) ? clientVersion : null;
         }
-        
+
+        /// <summary>
+        /// Get the current protocol version from the request.
+        /// </summary>
+        private NuGetVersion GetProtocolVersion(UserSecurityPolicyEvaluationContext context)
+        {
+            var protocolVersionString = context.HttpContext.Request?.Headers[Constants.NuGetProtocolHeaderName];
+
+            NuGetVersion protocolVersion;
+            return NuGetVersion.TryParse(protocolVersionString, out protocolVersion) ? protocolVersion : null;
+        }
+
         /// <summary>
         /// Evaluate if this security policy is met.
         /// </summary>
@@ -76,8 +86,16 @@ public override SecurityPolicyResult Evaluate(UserSecurityPolicyEvaluationContex
 
             var minClientVersion = GetMaxOfMinClientVersions(context);
 
-            var clientVersion = GetClientVersion(context);
-            if (clientVersion == null || clientVersion < minClientVersion)
+            // Do we have X-NuGet-Protocol-Version header?
+            var protocolVersion = GetProtocolVersion(context);
+
+            if (protocolVersion == null)
+            {
+                // Do we have X-NuGet-Client-Version header?
+                protocolVersion = GetClientVersion(context);
+            }
+            
+            if (protocolVersion == null || protocolVersion < minClientVersion)
             {
                 return SecurityPolicyResult.CreateErrorResult(string.Format(CultureInfo.CurrentCulture,
                     Strings.SecurityPolicy_RequireMinClientVersionForPush, minClientVersion));
diff --git a/src/NuGetGallery/Services/TelemetryService.cs b/src/NuGetGallery/Services/TelemetryService.cs
index c84dc2704b..b8376c0879 100644
--- a/src/NuGetGallery/Services/TelemetryService.cs
+++ b/src/NuGetGallery/Services/TelemetryService.cs
@@ -26,6 +26,7 @@ public class TelemetryService : ITelemetryService
         public const string AuthenticationMethod = "AuthenticationMethod";
         public const string AccountCreationDate = "AccountCreationDate";
         public const string ClientVersion = "ClientVersion";
+        public const string ProtocolVersion = "ProtocolVersion";
         public const string IsScoped = "IsScoped";
         public const string KeyCreationDate = "KeyCreationDate";
         public const string PackageId = "PackageId";
@@ -66,6 +67,7 @@ public void TrackPackagePushEvent(Package package, User user, IIdentity identity
 
             TrackEvent(PackagePushEvent, properties => {
                 properties.Add(ClientVersion, GetClientVersion());
+                properties.Add(ProtocolVersion, GetProtocolVersion());
                 properties.Add(PackageId, package.PackageRegistration.Id);
                 properties.Add(PackageVersion, package.Version);
                 properties.Add(AuthenticationMethod, identity.GetAuthenticationType());
@@ -89,6 +91,7 @@ public void TrackCreatePackageVerificationKeyEvent(string packageId, string pack
 
             TrackEvent(CreatePackageVerificationKeyEvent, properties => {
                 properties.Add(ClientVersion, GetClientVersion());
+                properties.Add(ProtocolVersion, GetProtocolVersion());
                 properties.Add(PackageId, packageId);
                 properties.Add(PackageVersion, packageVersion);
                 properties.Add(AccountCreationDate, GetAccountCreationDate(user));
@@ -124,6 +127,11 @@ private static string GetClientVersion()
             return HttpContext.Current?.Request?.Headers[Constants.ClientVersionHeaderName];
         }
 
+        private static string GetProtocolVersion()
+        {
+            return HttpContext.Current?.Request?.Headers[Constants.NuGetProtocolHeaderName];
+        }
+
         private static string GetAccountCreationDate(User user)
         {
             return user.CreatedUtc?.ToString("O") ?? "N/A";
diff --git a/src/NuGetGallery/Telemetry/ClientInformationTelemetryEnricher.cs b/src/NuGetGallery/Telemetry/ClientInformationTelemetryEnricher.cs
index 2dcbc13484..2a7eee21a4 100644
--- a/src/NuGetGallery/Telemetry/ClientInformationTelemetryEnricher.cs
+++ b/src/NuGetGallery/Telemetry/ClientInformationTelemetryEnricher.cs
@@ -10,7 +10,6 @@ namespace NuGetGallery
 {
     public class ClientInformationTelemetryEnricher : ITelemetryInitializer
     {
-        public const string ClientVersionPropertyKey = "ClientVersion";
         public const string ClientInfoPropertyKey = "ClientInfo";
 
         public void Initialize(ITelemetry telemetry)
@@ -22,11 +21,16 @@ public void Initialize(ITelemetry telemetry)
                 var httpContext = GetHttpContext();
                 if (httpContext != null && httpContext.Request != null)
                 {
-                    // ClientVersion will be available for NuGet clients starting version 4.1.0
+                    // ClientVersion is available for NuGet clients starting version 4.1.0-~4.5.0 
+                    // Was deprecated and replaced by Protocol version
                     telemetry.Context.Properties.Add(
-                        ClientVersionPropertyKey,
+                        TelemetryService.ClientVersion,
                         httpContext.Request.Headers[Constants.ClientVersionHeaderName]);
 
+                    telemetry.Context.Properties.Add(
+                        TelemetryService.ProtocolVersion,
+                        httpContext.Request.Headers[Constants.NuGetProtocolHeaderName]);
+
                     // Best effort attempt to extract client information from the user-agent header.
                     // According to documentation here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent 
                     // the common structure for user-agent header is:
@@ -36,7 +40,6 @@ public void Initialize(ITelemetry telemetry)
                     telemetry.Context.Properties.Add(ClientInfoPropertyKey, GetProductInformation(userAgent));
                 }
             }
-            
         }
 
         protected virtual HttpContextBase GetHttpContext()
diff --git a/tests/NuGetGallery.Facts/Security/RequireMinClientVersionForPushPolicyFacts.cs b/tests/NuGetGallery.Facts/Security/RequireMinClientVersionForPushPolicyFacts.cs
index 30ddf6531f..8d7c3077eb 100644
--- a/tests/NuGetGallery.Facts/Security/RequireMinClientVersionForPushPolicyFacts.cs
+++ b/tests/NuGetGallery.Facts/Security/RequireMinClientVersionForPushPolicyFacts.cs
@@ -20,7 +20,7 @@ public class RequireMinClientVersionForPushPolicyFacts
         public void Evaluate_ReturnsSuccessIfClientVersionEqualOrHigherThanRequired(string minClientVersions)
         {
             // Arrange & Act
-            var result = Evaluate(minClientVersions, actualClientVersion: "4.1.0");
+            var result = Evaluate(minClientVersions, actualClientVersion: "4.1.0", actualProtocolVersion: string.Empty);
 
             // Assert
             Assert.True(result.Success);
@@ -35,31 +35,88 @@ public void Evaluate_ReturnsSuccessIfClientVersionEqualOrHigherThanRequired(stri
         public void Evaluate_ReturnsFailureIfClientVersionLowerThanRequired(string minClientVersions)
         {
             // Arrange & Act
-            var result = Evaluate(minClientVersions, actualClientVersion: "2.5.0-beta1");
+            var result = Evaluate(minClientVersions, actualClientVersion: "2.5.0-beta1", actualProtocolVersion: string.Empty);
+
+            // Assert
+            Assert.False(result.Success);
+            Assert.NotNull(result.ErrorMessage);
+        }
+
+        [Theory]
+        [InlineData("4.1.0")]
+        [InlineData("3.0.0")]
+        [InlineData("2.0.0,4.1.0")]
+        [InlineData("4.1.0-beta1")]
+        public void Evaluate_ReturnsSuccessIfProtocolVersionEqualOrHigherThanRequired(string minClientVersions)
+        {
+            // Arrange & Act
+            var result = Evaluate(minClientVersions, actualClientVersion: string.Empty, actualProtocolVersion: "4.1.0");
+
+            // Assert
+            Assert.True(result.Success);
+            Assert.Null(result.ErrorMessage);
+        }
+
+        [Theory]
+        [InlineData("4.1.0")]
+        [InlineData("3.0.0")]
+        [InlineData("2.0.0,4.1.0")]
+        [InlineData("2.5.0")]
+        public void Evaluate_ReturnsFailureIfProtocolVersionLowerThanRequired(string minClientVersions)
+        {
+            // Arrange & Act
+            var result = Evaluate(minClientVersions, actualClientVersion: string.Empty, actualProtocolVersion: "2.5.0-beta1");
+
+            // Assert
+            Assert.False(result.Success);
+            Assert.NotNull(result.ErrorMessage);
+        }
+
+        [Fact]
+        public void Evaluate_ReturnsFailureIfProtocolVersionLowerThenRequiredAndClientVersionHigher()
+        {
+            // Arrange & Act
+            var result = Evaluate("4.1.0", actualClientVersion: "4.1.0", actualProtocolVersion: "2.5.0-beta1");
 
             // Assert
             Assert.False(result.Success);
             Assert.NotNull(result.ErrorMessage);
         }
 
+        [Fact]
+        public void Evaluate_ReturnsSuccessIfProtocolVersionHigherThenRequiredAndClientVersionLower()
+        {
+            // Arrange & Act
+            var result = Evaluate("4.1.0", actualClientVersion: "2.5.0-beta1", actualProtocolVersion: "4.1.0");
+
+            // Assert
+            Assert.True(result.Success);
+            Assert.Null(result.ErrorMessage);
+        }
+
         [Fact]
         public void Evaluate_ReturnsFailureIfClientVersionHeaderIsMissing()
         {
             // Arrange & Act
-            var result = Evaluate(minClientVersions: "4.1.0", actualClientVersion: "");
+            var result = Evaluate(minClientVersions: "4.1.0", actualClientVersion: string.Empty, actualProtocolVersion: string.Empty);
 
             // Assert
             Assert.False(result.Success);
             Assert.NotNull(result.ErrorMessage);
         }
 
-        private SecurityPolicyResult Evaluate(string minClientVersions, string actualClientVersion)
+        private SecurityPolicyResult Evaluate(string minClientVersions, string actualClientVersion, string actualProtocolVersion)
         {
             var headers = new NameValueCollection();
             if (!string.IsNullOrEmpty(actualClientVersion))
             {
                 headers[Constants.ClientVersionHeaderName] = actualClientVersion;
-            };
+            }
+
+            if (!string.IsNullOrEmpty(actualProtocolVersion))
+            {
+                headers[Constants.NuGetProtocolHeaderName] = actualProtocolVersion;
+            }
 
             var httpRequest = new Mock<HttpRequestBase>();
             httpRequest.Setup(r => r.Headers).Returns(headers);
diff --git a/tests/NuGetGallery.Facts/Telemetry/ClientInformationTelemetryEnricherTests.cs b/tests/NuGetGallery.Facts/Telemetry/ClientInformationTelemetryEnricherTests.cs
index baaf4a2e27..de85b7ead1 100644
--- a/tests/NuGetGallery.Facts/Telemetry/ClientInformationTelemetryEnricherTests.cs
+++ b/tests/NuGetGallery.Facts/Telemetry/ClientInformationTelemetryEnricherTests.cs
@@ -41,6 +41,7 @@ public void EnrichesOnlyRequestsTelemetry(Type telemetryType)
 
             var headers = new NameValueCollection
             {
+                { Constants.NuGetProtocolHeaderName, "1.0.0" },
                 { Constants.ClientVersionHeaderName, "1.0.0" },
                 { Constants.UserAgentHeaderName, "NuGet Command Line/4.1.0 (Microsoft Windows NT 6.2.9200.0)" }
             };
@@ -53,7 +54,7 @@ public void EnrichesOnlyRequestsTelemetry(Type telemetryType)
             // Assert
             if (telemetry is RequestTelemetry)
             {
-                Assert.Equal(3, telemetry.Context.Properties.Count);
+                Assert.Equal(4, telemetry.Context.Properties.Count);
             }
             else
             {
@@ -78,7 +79,27 @@ public void EnrichesTelemetryWithClientVersion()
             enricher.Initialize(telemetry);
 
             // Assert
-            Assert.Equal("5.0.0", telemetry.Properties[ClientInformationTelemetryEnricher.ClientVersionPropertyKey]);
+            Assert.Equal("5.0.0", telemetry.Properties[TelemetryService.ClientVersion]);
+        }
+
+        [Fact]
+        public void EnrichesTelemetryWithProtocolVersion()
+        {
+            // Arrange
+            var telemetry = new RequestTelemetry();
+
+            var headers = new NameValueCollection
+            {
+                { Constants.NuGetProtocolHeaderName, "5.0.0" }
+            };
+
+            var enricher = CreateTestEnricher(headers);
+
+            // Act
+            enricher.Initialize(telemetry);
+
+            // Assert
+            Assert.Equal("5.0.0", telemetry.Properties[TelemetryService.ProtocolVersion]);
         }
 
         [Theory]

From 1f70c3ae6192e0d9e808439e62ae88316c49bac1 Mon Sep 17 00:00:00 2001
From: Svetlana Kofman <skofman@microsoft.com>
Date: Mon, 25 Sep 2017 16:26:58 -0700
Subject: [PATCH 09/25] Functional test for X-NuGet-Protocol-Version support
 (#4743)

* Functional tests for X-NuGet-Protocol-

* Fix description
---
 .../Constants.cs                              |  1 +
 .../PackageCreation/SecurityPolicyTests.cs    | 22 ++++++++++++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/tests/NuGetGallery.FunctionalTests.Core/Constants.cs b/tests/NuGetGallery.FunctionalTests.Core/Constants.cs
index e3e4da51c8..f2e283223a 100644
--- a/tests/NuGetGallery.FunctionalTests.Core/Constants.cs
+++ b/tests/NuGetGallery.FunctionalTests.Core/Constants.cs
@@ -8,6 +8,7 @@ public static class Constants
         // Headers
         public const string NuGetHeaderApiKey = "X-NuGet-ApiKey";
         public const string NuGetHeaderClientVersion = "X-NuGet-Client-Version";
+        public const string NuGetHeaderProtocolVersion = "X-NuGet-Protocol-Version";
 
         // Form Fields
         public const string ConfirmPasswordFormField = "ConfirmPassword";
diff --git a/tests/NuGetGallery.FunctionalTests/PackageCreation/SecurityPolicyTests.cs b/tests/NuGetGallery.FunctionalTests/PackageCreation/SecurityPolicyTests.cs
index a79a188ee1..75bffbc35f 100644
--- a/tests/NuGetGallery.FunctionalTests/PackageCreation/SecurityPolicyTests.cs
+++ b/tests/NuGetGallery.FunctionalTests/PackageCreation/SecurityPolicyTests.cs
@@ -60,6 +60,22 @@ public async Task PackagePush_Returns200IfMinClientVersionPolicyMet(string clien
             Assert.Equal(HttpStatusCode.Created, response.StatusCode);
         }
 
+        [Fact]
+        [Description("Package push succeeds if min protocol version policy met")]
+        [Priority(1)]
+        [Category("P1Tests")]
+        public async Task PackagePush_Returns200IfMinProtocolVersionPolicyMet()
+        {
+            // Arrange
+            var id = $"{nameof(PackagePush_Returns200IfMinProtocolVersionPolicyMet)}.{DateTime.UtcNow.Ticks}";
+
+            // Act
+            var response = await PushPackageAsync(EnvironmentSettings.TestSecurityPoliciesAccountApiKey, id, clientVersion: null, protocolVersion: "4.1.0");
+
+            // Assert
+            Assert.Equal(HttpStatusCode.Created, response.StatusCode);
+        }
+
         [Fact]
         [Description("VerifyPackageKey fails if package verify policy not met")]
         [Priority(1)]
@@ -145,7 +161,7 @@ public async Task VerifyPackageKey_Returns200ForTempApiKey()
             Assert.Equal(HttpStatusCode.Forbidden, await VerifyPackageKey(verificationKey, packageId, packageVersion));
         }
 
-        private async Task<HttpResponseMessage> PushPackageAsync(string apiKey, string packageId, string clientVersion = null)
+        private async Task<HttpResponseMessage> PushPackageAsync(string apiKey, string packageId, string clientVersion = null, string protocolVersion = null)
         {
             var packageCreationHelper = new PackageCreationHelper(TestOutputHelper);
             var packagePath = await packageCreationHelper.CreatePackage(packageId);
@@ -158,6 +174,10 @@ private async Task<HttpResponseMessage> PushPackageAsync(string apiKey, string p
                 {
                     request.Headers.Add(Constants.NuGetHeaderClientVersion, clientVersion);
                 }
+                if (protocolVersion != null)
+                {
+                    request.Headers.Add(Constants.NuGetHeaderProtocolVersion, protocolVersion); 
+                }
                 request.Content = new StreamContent(new FileStream(packagePath, FileMode.Open));
 
                 return await httpClient.SendAsync(request);

From 7590d5a87e9d8587eac6e7b5b5a46c99d8832d79 Mon Sep 17 00:00:00 2001
From: Scott Bommarito <scottbom@microsoft.com>
Date: Mon, 25 Sep 2017 17:01:03 -0700
Subject: [PATCH 10/25] Remove redesign banner (#4741)

---
 src/NuGetGallery/Configuration/AppConfiguration.cs  |  3 ---
 src/NuGetGallery/Configuration/IAppConfiguration.cs |  5 -----
 src/NuGetGallery/Views/Shared/Gallery/Header.cshtml | 12 ------------
 src/NuGetGallery/Views/Shared/Layout.cshtml         |  9 ---------
 src/NuGetGallery/Web.config                         |  2 --
 5 files changed, 31 deletions(-)

diff --git a/src/NuGetGallery/Configuration/AppConfiguration.cs b/src/NuGetGallery/Configuration/AppConfiguration.cs
index 163b1ef968..0ad9d2b62c 100644
--- a/src/NuGetGallery/Configuration/AppConfiguration.cs
+++ b/src/NuGetGallery/Configuration/AppConfiguration.cs
@@ -16,9 +16,6 @@ public class AppConfiguration : IAppConfiguration
         [DefaultValue("")]
         public string WarningBanner { get; set; }
 
-        [DefaultValue("")]
-        public string RedesignBanner { get; set; }
-
         /// <summary>
         /// Gets a setting indicating if SSL is required for all operations once logged in.
         /// </summary>
diff --git a/src/NuGetGallery/Configuration/IAppConfiguration.cs b/src/NuGetGallery/Configuration/IAppConfiguration.cs
index 4e6d7ae502..175f09ceca 100644
--- a/src/NuGetGallery/Configuration/IAppConfiguration.cs
+++ b/src/NuGetGallery/Configuration/IAppConfiguration.cs
@@ -23,11 +23,6 @@ public interface IAppConfiguration
         /// </summary>
         string WarningBanner { get; set; }
 
-        /// <summary>
-        /// Gets the warning banner text
-        /// </summary>
-        string RedesignBanner { get; set; }
-
         /// <summary>
         /// Gets a setting indicating if SSL is required for all operations once logged in.
         /// </summary>
diff --git a/src/NuGetGallery/Views/Shared/Gallery/Header.cshtml b/src/NuGetGallery/Views/Shared/Gallery/Header.cshtml
index cb947cd7e5..0a91850f7a 100644
--- a/src/NuGetGallery/Views/Shared/Gallery/Header.cshtml
+++ b/src/NuGetGallery/Views/Shared/Gallery/Header.cshtml
@@ -10,18 +10,6 @@
     </div>
 }
 
-@if (!string.IsNullOrWhiteSpace(Config.Current.RedesignBanner))
-{
-    <div class="container-fluid banner banner-notice text-center">
-        <div class="row">
-            <div class="col-sm-12">
-                <i class="ms-Icon ms-Icon--Info" aria-hidden="true"></i>
-                <span>@Html.Raw(WebUtility.HtmlDecode(Config.Current.RedesignBanner))</span>
-            </div>
-        </div>
-    </div>
-}
-
 @if (CookieConsentMessage != null)
 {
     <div class="container-fluid banner banner-notice text-center">
diff --git a/src/NuGetGallery/Views/Shared/Layout.cshtml b/src/NuGetGallery/Views/Shared/Layout.cshtml
index eb873b75ae..10c695fdfc 100644
--- a/src/NuGetGallery/Views/Shared/Layout.cshtml
+++ b/src/NuGetGallery/Views/Shared/Layout.cshtml
@@ -44,15 +44,6 @@
                 <div class="banner-warning">@Config.Current.WarningBanner</div>
             </div>
         }
-        @if (!string.IsNullOrEmpty(Config.Current.RedesignBanner))
-        {
-            <div id="service-alert">
-                <div class="banner-redesign">
-                    <i class="ms-Icon ms-Icon--Warning" aria-hidden="true"></i>
-                    @Html.Raw(WebUtility.HtmlDecode(Config.Current.RedesignBanner))
-                </div>
-            </div>
-        }
 
         <div id="outer-wrapper">
             <div id="content-wrapper">
diff --git a/src/NuGetGallery/Web.config b/src/NuGetGallery/Web.config
index 164d9f4944..2e7bf6e8a7 100644
--- a/src/NuGetGallery/Web.config
+++ b/src/NuGetGallery/Web.config
@@ -48,8 +48,6 @@
     
     <!-- banner warning on the top - leave blank to remove the banner from the site. -->
     <add key="Gallery.WarningBanner" value="" />
-    <!-- redesign banner on the top - leave blank to remove the banner from the site. -->
-    <add key="Gallery.RedesignBanner" value="" />
 
     <add key="Gallery.FacebookAppId" value="" />
     <!-- Set this if you have a Application Insights instrumentation key to use for your gallery deployment -->

From f9f04f37eec852ff23a0777025dbe4a54073a39d Mon Sep 17 00:00:00 2001
From: Xavier Decoster <xavierdecoster@users.noreply.github.com>
Date: Tue, 26 Sep 2017 18:49:58 +0200
Subject: [PATCH 11/25] Fix redirect issue behind APIM (#4746)

* Fixed some missing Url.Action calls in razor views + fixed test

* Ensure redirects take into account the SiteRoot config setting
---
 src/NuGetGallery/App_Code/ViewHelpers.cshtml  |  4 +-
 .../Controllers/AuthenticationController.cs   |  4 +-
 src/NuGetGallery/UrlExtensions.cs             | 65 ++++++++++++++++++-
 .../Views/Shared/Gallery/Header.cshtml        |  2 +-
 src/NuGetGallery/Views/Users/ApiKeys.cshtml   |  8 +--
 .../AuthenticationControllerFacts.cs          | 12 +++-
 .../TestUtils/ResultAssert.cs                 | 18 +++--
 .../NuGetGallery.Facts/UrlExtensionsFacts.cs  | 24 ++++++-
 .../Views/UrlHelperFacts.cs                   |  4 +-
 9 files changed, 121 insertions(+), 20 deletions(-)

diff --git a/src/NuGetGallery/App_Code/ViewHelpers.cshtml b/src/NuGetGallery/App_Code/ViewHelpers.cshtml
index b9ae1111e8..85c84d5f5d 100644
--- a/src/NuGetGallery/App_Code/ViewHelpers.cshtml
+++ b/src/NuGetGallery/App_Code/ViewHelpers.cshtml
@@ -107,9 +107,9 @@
                     }
                 </div>
 
-                <p class="error-action">Get me out of here! <a href="@url.Action("Home", "Pages")">Go home</a></p>
+                <p class="error-action">Get me out of here! <a href="@url.Home()">Go home</a></p>
                 <p class="error-action">Wondering if NuGet is down? <a href="https://status.nuget.org/">Check our status</a></p>
-                <p class="error-action">Looking for a package? <a href="@url.Action("ListPackages", "Packages")">Try searching</a></p>
+                <p class="error-action">Looking for a package? <a href="@url.PackageList()">Try searching</a></p>
                 <p class="error-action">Package you're looking for doesn't exist? <a href="https://docs.microsoft.com/en-us/nuget/quickstart/create-and-publish-a-package">Make one</a></p>
                 <p class="error-action">Pretty sure we messed up? <a href="https://github.com/NuGet/NuGetGallery/issues">File a bug</a></p>
                 <p class="error-action">Can't get enough NuGet? <a href="https://twitter.com/nuget">Follow us</a></p>
diff --git a/src/NuGetGallery/Controllers/AuthenticationController.cs b/src/NuGetGallery/Controllers/AuthenticationController.cs
index 84a8cc0796..398f53628d 100644
--- a/src/NuGetGallery/Controllers/AuthenticationController.cs
+++ b/src/NuGetGallery/Controllers/AuthenticationController.cs
@@ -193,7 +193,7 @@ internal bool ShouldChallengeEnforcedProvider(string enforcedProviders, Authenti
         [HttpGet]
         public virtual ActionResult RegisterLegacy(string returnUrl)
         {
-            return RedirectToAction("LogOn", new { returnUrl });
+            return Redirect(Url.LogOn(returnUrl, relativeUrl: false));
         }
         
         [HttpPost]
@@ -425,7 +425,7 @@ private ActionResult ExternalLinkExpired()
             // User got here without an external login cookie (or an expired one)
             // Send them to the logon action with a message
             TempData["Message"] = Strings.ExternalAccountLinkExpired;
-            return RedirectToAction("LogOn");
+            return Redirect(Url.LogOn(null, relativeUrl: false));
         }
 
         private ActionResult SignInOrExternalLinkView(LogOnViewModel model, bool linkingAccount)
diff --git a/src/NuGetGallery/UrlExtensions.cs b/src/NuGetGallery/UrlExtensions.cs
index 15e2214b71..ffffbf44aa 100644
--- a/src/NuGetGallery/UrlExtensions.cs
+++ b/src/NuGetGallery/UrlExtensions.cs
@@ -770,9 +770,29 @@ public static string Authenticate(this UrlHelper url, string providerName, strin
                 });
         }
 
+        public static string RemoveCredential(this UrlHelper url, bool relativeUrl = true)
+        {
+            return GetActionLink(url, "RemoveCredential", "Users", relativeUrl);
+        }
+
+        public static string RegenerateCredential(this UrlHelper url, bool relativeUrl = true)
+        {
+            return GetActionLink(url, "RegenerateCredential", "Users", relativeUrl);
+        }
+
+        public static string EditCredential(this UrlHelper url, bool relativeUrl = true)
+        {
+            return GetActionLink(url, "EditCredential", "Users", relativeUrl);
+        }
+
+        public static string GenerateApiKey(this UrlHelper url, bool relativeUrl = true)
+        {
+            return GetActionLink(url, "GenerateApiKey", "Users", relativeUrl);
+        }
+
         private static UriBuilder GetCanonicalUrl(UrlHelper url)
         {
-            UriBuilder builder = new UriBuilder(url.RequestContext.HttpContext.Request.Url);
+            var builder = new UriBuilder(url.RequestContext.HttpContext.Request.Url);
             builder.Query = String.Empty;
             if (builder.Host.StartsWith("www.", StringComparison.OrdinalIgnoreCase))
             {
@@ -804,6 +824,15 @@ private static string GetActionLink(
             var protocol = GetProtocol(url);
             var hostName = GetConfiguredSiteHostName();
 
+
+            if (routeValues != null && routeValues.ContainsKey("ReturnUrl"))
+            {
+                routeValues["ReturnUrl"] = GetAbsoluteReturnUrl(
+                    routeValues["ReturnUrl"]?.ToString(),
+                    protocol,
+                    hostName);
+            }
+
             var actionLink = url.Action(actionName, controllerName, routeValues, protocol, hostName);
 
             if (relativeUrl)
@@ -832,5 +861,39 @@ private static string GetRouteLink(
 
             return routeLink;
         }
+
+        internal static string GetAbsoluteReturnUrl(
+            string returnUrl,
+            string protocol,
+            string configuredSiteRootHostName)
+        {
+            // Ensure return URL is always pointing to the configured siteroot
+            // to avoid MVC routing to use the deployment host name instead of the configured one.
+            // This is important when deployed behind a proxy, such as APIM.
+            if (returnUrl != null 
+                && Uri.TryCreate(returnUrl, UriKind.RelativeOrAbsolute, out var returnUri))
+            {
+                if (!returnUri.IsAbsoluteUri)
+                {
+                    var baseUri = new Uri($"{protocol}://{configuredSiteRootHostName}");
+                    returnUri = new Uri(baseUri, returnUri);
+                }
+
+                var uriBuilder = new UriBuilder(returnUri);
+                uriBuilder.Host = configuredSiteRootHostName;
+                uriBuilder.Port = returnUri.IsDefaultPort ? -1 : returnUri.Port;
+
+                if (string.IsNullOrEmpty(uriBuilder.Query))
+                {
+                    return uriBuilder.ToString().TrimEnd('/');
+                }
+
+                return uriBuilder.ToString();
+            }
+
+            // This only happens when the returnUrl did not have a valid Uri format,
+            // so we can safely strip this value.
+            return string.Empty;
+        }
     }
 }
diff --git a/src/NuGetGallery/Views/Shared/Gallery/Header.cshtml b/src/NuGetGallery/Views/Shared/Gallery/Header.cshtml
index 0a91850f7a..e949de59e1 100644
--- a/src/NuGetGallery/Views/Shared/Gallery/Header.cshtml
+++ b/src/NuGetGallery/Views/Shared/Gallery/Header.cshtml
@@ -68,7 +68,7 @@
                         }
                         @if (Request.IsAuthenticated && User.IsInRole(Constants.AdminRoleName))
                         {
-                            @DisplayNavigationItem("Admin", Url.Action("Index", "Home", new { area = "Admin" }))
+                            @DisplayNavigationItem("Admin", Url.Admin())
                         }
                         @DisplayNavigationItem("Documentation", "https://docs.microsoft.com/en-us/nuget/")
                         @DisplayNavigationItem("Downloads", Url.Downloads())
diff --git a/src/NuGetGallery/Views/Users/ApiKeys.cshtml b/src/NuGetGallery/Views/Users/ApiKeys.cshtml
index b3d42ba568..e75769bfed 100644
--- a/src/NuGetGallery/Views/Users/ApiKeys.cshtml
+++ b/src/NuGetGallery/Views/Users/ApiKeys.cshtml
@@ -464,10 +464,10 @@
                          ApiKeys = Model.ApiKeys,
                          PackageIds = Model.PackageIds,
                          PackagePushScope = NuGetScopes.PackagePush,
-                         RemoveUrl = Url.Action("RemoveCredential", "Users"),
-                         RegenerateUrl = Url.Action("RegenerateCredential", "Users"),
-                         EditUrl = Url.Action("EditCredential", "Users"),
-                         GenerateUrl = Url.Action("GenerateApiKey", "Users"),
+                         RemoveUrl = Url.RemoveCredential(),
+                         RegenerateUrl = Url.RegenerateCredential(),
+                         EditUrl = Url.EditCredential(),
+                         GenerateUrl = Url.GenerateApiKey(),
                          ImageUrls = new {
                              ApiKey = Url.Absolute("~/Content/gallery/img/api-key.svg"),
                              ApiKeyFallback = Url.Absolute("~/Content/gallery/img/api-key-256x256.png"),
diff --git a/tests/NuGetGallery.Facts/Controllers/AuthenticationControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/AuthenticationControllerFacts.cs
index c0a4a518b7..1feffd1b4c 100644
--- a/tests/NuGetGallery.Facts/Controllers/AuthenticationControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/AuthenticationControllerFacts.cs
@@ -15,6 +15,7 @@
 using NuGetGallery.Authentication.Providers.MicrosoftAccount;
 using NuGetGallery.Infrastructure.Authentication;
 using Xunit;
+using System.Web;
 
 namespace NuGetGallery.Controllers
 {
@@ -724,14 +725,19 @@ public class TheAuthenticateAction : TestContainer
             public void WillChallengeTheUserUsingTheGivenProviderAndReturnUrl()
             {
                 // Arrange
+                const string returnUrl = "/theReturnUrl";
                 EnableAllAuthenticators(Get<AuthenticationService>());
                 var controller = GetController<AuthenticationController>();
+                var absoluteReturnUrl = UrlExtensions.GetAbsoluteReturnUrl(
+                    returnUrl,
+                    "https",
+                    new Uri(GetConfigurationService().GetSiteRoot(useHttps: true)).Host);
 
                 // Act
-                var result = controller.ChallengeAuthentication("/theReturnUrl", "MicrosoftAccount");
+                var result = controller.ChallengeAuthentication(returnUrl, "MicrosoftAccount");
 
                 // Assert
-                ResultAssert.IsChallengeResult(result, "MicrosoftAccount", "/users/account/authenticate/return?ReturnUrl=%2FtheReturnUrl");
+                ResultAssert.IsChallengeResult(result, "MicrosoftAccount", "/users/account/authenticate/return?ReturnUrl=" + HttpUtility.UrlEncode(absoluteReturnUrl));
             }
         }
 
@@ -1024,7 +1030,7 @@ public void VerifyShouldChallenge(string providerUsedForLogin, bool shouldChalle
 
         public static void VerifyExternalLinkExpiredResult(AuthenticationController controller, ActionResult result)
         {
-            ResultAssert.IsRedirectToRoute(result, new { action = "LogOn" });
+            ResultAssert.IsRedirect(result, permanent: false, url: controller.Url.LogOn(relativeUrl: false));
             Assert.Equal(Strings.ExternalAccountLinkExpired, controller.TempData["Message"]);
         }
 
diff --git a/tests/NuGetGallery.Facts/TestUtils/ResultAssert.cs b/tests/NuGetGallery.Facts/TestUtils/ResultAssert.cs
index 84ad0024ee..815c223573 100644
--- a/tests/NuGetGallery.Facts/TestUtils/ResultAssert.cs
+++ b/tests/NuGetGallery.Facts/TestUtils/ResultAssert.cs
@@ -2,10 +2,7 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 using System;
 using System.Collections.Generic;
-using System.Linq;
 using System.Net;
-using System.Text;
-using System.Threading.Tasks;
 using System.Web.Mvc;
 using System.Web.Routing;
 using Xunit;
@@ -52,6 +49,14 @@ public static RedirectToRouteResult IsRedirectToRoute(ActionResult result, objec
             return redirect;
         }
 
+        public static RedirectResult IsRedirect(ActionResult result, bool permanent, string url)
+        {
+            var redirect = Assert.IsType<RedirectResult>(result);
+            Assert.Equal(permanent, redirect.Permanent);
+            Assert.Equal(url, redirect.Url);
+            return redirect;
+        }
+
         public static ViewResult IsView(ActionResult result, string viewName = "", string masterName = "", object viewData = null)
         {
             var view = Assert.IsType<ViewResult>(result);
@@ -137,7 +142,12 @@ public static ChallengeResult IsChallengeResult(ActionResult result, string prov
         public static ChallengeResult IsChallengeResult(ActionResult result, string provider, string redirectUrl)
         {
             var challenge = Assert.IsType<ChallengeResult>(result);
-            Assert.Equal(redirectUrl, challenge.RedirectUri);
+
+            // Need to ignore case as Url.Action and HttpUtility.UrlEncode may use different casing for escaped characters...
+            // /users/account/authenticate/return?ReturnUrl=https%3a%2f%2flocalhost%2ftheReturnUrl
+            // /users/account/authenticate/return?ReturnUrl=https%3A%2F%2Flocalhost%2FtheReturnUrl
+            Assert.Equal(redirectUrl, challenge.RedirectUri, ignoreCase: true);
+
             Assert.Equal(provider, challenge.LoginProvider);
             return challenge;
         }
diff --git a/tests/NuGetGallery.Facts/UrlExtensionsFacts.cs b/tests/NuGetGallery.Facts/UrlExtensionsFacts.cs
index e650049cd0..0c26b2a517 100644
--- a/tests/NuGetGallery.Facts/UrlExtensionsFacts.cs
+++ b/tests/NuGetGallery.Facts/UrlExtensionsFacts.cs
@@ -1,7 +1,8 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using NuGetGallery.Framework;
 using System;
-using System.Web.Mvc;
 using Xunit;
 
 namespace NuGetGallery
@@ -26,6 +27,7 @@ public void PropagatesNull()
         }
 
         public class ThePackageHelperMethod
+            : TestContainer
         {
             [Fact]
             public void UsesNormalizedVersionInUrls()
@@ -46,5 +48,25 @@ public void UsesNormalizedVersionInUrls()
                 Assert.EndsWith(package.NormalizedVersion, fixedUrl);
             }
         }
+
+        public class TheGetAbsoluteReturnUrlMethod
+        {
+            [Theory]
+            [InlineData("/", "https", "unittest.nuget.org", "https://unittest.nuget.org")]
+            [InlineData("/Account/SignIn", "https", "unittest.nuget.org", "https://unittest.nuget.org/Account/SignIn")]
+            [InlineData("https://localhost", "https", "unittest.nuget.org", "https://unittest.nuget.org")]
+            [InlineData("https://localhost/Account/SignIn", "https", "unittest.nuget.org", "https://unittest.nuget.org/Account/SignIn")]
+            [InlineData("https://localhost/Account/SignIn?returnUrl=%2F", "https", "unittest.nuget.org", "https://unittest.nuget.org/Account/SignIn?returnUrl=%2F")]
+            public void UsesConfiguredSiteRootInAbsoluteUri(
+                string returnUrl, 
+                string protocol, 
+                string hostName,
+                string expectedReturnUrl)
+            {
+                var absoluteReturnUrl = UrlExtensions.GetAbsoluteReturnUrl(returnUrl, protocol, hostName);
+
+                Assert.Equal(expectedReturnUrl, absoluteReturnUrl);
+            }
+        }
     }
 }
diff --git a/tests/NuGetGallery.Facts/Views/UrlHelperFacts.cs b/tests/NuGetGallery.Facts/Views/UrlHelperFacts.cs
index 0803977da2..50a7243bc6 100644
--- a/tests/NuGetGallery.Facts/Views/UrlHelperFacts.cs
+++ b/tests/NuGetGallery.Facts/Views/UrlHelperFacts.cs
@@ -22,8 +22,8 @@ public UrlHelperFacts(ITestOutputHelper testOutputHelper)
         }
 
         [Theory]
-        [InlineData("@Url.Action")]
-        [InlineData("@Url.Route")]
+        [InlineData("Url.Action")]
+        [InlineData("Url.Route")]
         public void ViewsDoNotUseDefaultUrlHelperRoutes(string unsupportedTerm)
         {
             // We should not use Url.Action or Url.Route in our views as the gallery

From a83a60702fab561724d434528597f1b18ae5cdff Mon Sep 17 00:00:00 2001
From: Scott Bommarito <scottbom@microsoft.com>
Date: Tue, 26 Sep 2017 11:55:28 -0700
Subject: [PATCH 12/25] remove ownerrequests.cshtml from csproj (#4752)

---
 src/NuGetGallery/NuGetGallery.csproj | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/NuGetGallery/NuGetGallery.csproj b/src/NuGetGallery/NuGetGallery.csproj
index 40c15dc526..bfd47628cf 100644
--- a/src/NuGetGallery/NuGetGallery.csproj
+++ b/src/NuGetGallery/NuGetGallery.csproj
@@ -1884,7 +1884,6 @@
     <Content Include="Views\Packages\_ImportReadMe.cshtml" />
     <Content Include="Views\Packages\_SubmitPackage.cshtml" />
     <Content Include="Views\Packages\_EditForm.cshtml" />
-    <Content Include="Views\Users\OwnerRequests.cshtml" />
     <Content Include="Views\Users\_OwnerRequestsList.cshtml" />
   </ItemGroup>
   <ItemGroup>

From 950f73405d56b134477cd26e844759223d9ea275 Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Tue, 26 Sep 2017 15:31:51 -0700
Subject: [PATCH 13/25] Enqueue to validation queue when a package is created
 (#4677)

Progress on https://github.com/NuGet/NuGetGallery/issues/4646
---
 src/NuGetGallery.Core/PackageStatus.cs        |  14 ++
 .../Services/CorePackageService.cs            |   3 +-
 .../App_Start/DefaultDependenciesModule.cs    |  41 ++++++
 .../Configuration/AppConfiguration.cs         |   2 +
 .../Configuration/ConfigurationService.cs     |  25 ++--
 .../Configuration/IAppConfiguration.cs        |   5 +
 .../Configuration/IServiceBusConfiguration.cs |  25 ++++
 .../Configuration/ServiceBusConfiguration.cs  |  16 +++
 src/NuGetGallery/Controllers/ApiController.cs |   3 +-
 .../Controllers/PackagesController.cs         |   3 +-
 src/NuGetGallery/NuGetGallery.csproj          |  20 ++-
 .../AsynchronousPackageValidationInitiator.cs |  62 +++++++++
 src/NuGetGallery/Services/IPackageService.cs  |   6 +-
 .../Services/IPackageUploadService.cs         |   2 +-
 .../Services/IPackageValidationInitiator.cs   |  25 ++++
 .../Services/IReservedNamespaceService.cs     |   6 +-
 .../Services/IValidationService.cs            |  20 +++
 .../Services/ImmediatePackageValidator.cs     |  19 +++
 src/NuGetGallery/Services/PackageService.cs   |  54 +-------
 .../Services/PackageUploadService.cs          |  26 ++--
 .../Services/ReservedNamespaceService.cs      |  12 +-
 .../Services/ValidationService.cs             |  32 +++++
 src/NuGetGallery/Strings.Designer.cs          |   9 ++
 src/NuGetGallery/Strings.resx                 |   5 +-
 src/NuGetGallery/Web.config                   |  33 +++++
 src/NuGetGallery/packages.config              |   4 +
 tests/NuGetGallery.Facts/App.config           |  26 ++++
 .../Controllers/ApiControllerFacts.cs         |  36 +++--
 .../Controllers/PackagesControllerFacts.cs    |  50 +++----
 .../NuGetGallery.Facts.csproj                 |  15 +++
 ...chronousPackageValidationInitiatorFacts.cs | 127 ++++++++++++++++++
 .../ImmediatePackageValidatorFacts.cs         |  28 ++++
 .../Services/PackageServiceFacts.cs           |  83 +-----------
 .../Services/PackageUploadServiceFacts.cs     |  88 +++++++-----
 .../Services/ReflowPackageServiceFacts.cs     |   2 -
 .../Services/ReservedNamespaceServiceFacts.cs |  28 ++--
 .../Services/ValidationServiceFacts.cs        |  68 ++++++++++
 .../TestUtils/TestServiceUtility.cs           |   2 -
 tests/NuGetGallery.Facts/packages.config      |   4 +
 39 files changed, 765 insertions(+), 264 deletions(-)
 create mode 100644 src/NuGetGallery/Configuration/IServiceBusConfiguration.cs
 create mode 100644 src/NuGetGallery/Configuration/ServiceBusConfiguration.cs
 create mode 100644 src/NuGetGallery/Services/AsynchronousPackageValidationInitiator.cs
 create mode 100644 src/NuGetGallery/Services/IPackageValidationInitiator.cs
 create mode 100644 src/NuGetGallery/Services/IValidationService.cs
 create mode 100644 src/NuGetGallery/Services/ImmediatePackageValidator.cs
 create mode 100644 src/NuGetGallery/Services/ValidationService.cs
 create mode 100644 tests/NuGetGallery.Facts/Services/AsynchronousPackageValidationInitiatorFacts.cs
 create mode 100644 tests/NuGetGallery.Facts/Services/ImmediatePackageValidatorFacts.cs
 create mode 100644 tests/NuGetGallery.Facts/Services/ValidationServiceFacts.cs

diff --git a/src/NuGetGallery.Core/PackageStatus.cs b/src/NuGetGallery.Core/PackageStatus.cs
index 2c42ffca44..8bc10e9a99 100644
--- a/src/NuGetGallery.Core/PackageStatus.cs
+++ b/src/NuGetGallery.Core/PackageStatus.cs
@@ -15,5 +15,19 @@ public enum PackageStatus
         /// version are still reserved.
         /// </summary>
         Deleted = 1,
+
+        /// <summary>
+        /// The package is in the process of being validated. The validation is being done asynchronously. When the
+        /// validation is complete it will move to the <see cref="Available"/>, <see cref="Deleted"/>, or
+        /// <see cref="FailedValidation"/> state. When packages are in this state, they are not available but the
+        /// package ID and version are still reserved.
+        /// </summary>
+        Validating = 2,
+
+        /// <summary>
+        /// The package has completed validation and the result has come back as a failure. When packages are in this
+        /// state, they are not available but the package ID and version are still reserved.
+        /// </summary>
+        FailedValidation = 3,
     }
 }
diff --git a/src/NuGetGallery.Core/Services/CorePackageService.cs b/src/NuGetGallery.Core/Services/CorePackageService.cs
index 1aa9dbca0a..e214acf5fe 100644
--- a/src/NuGetGallery.Core/Services/CorePackageService.cs
+++ b/src/NuGetGallery.Core/Services/CorePackageService.cs
@@ -2,7 +2,6 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
-using System.Collections.Generic;
 using System.Data.Entity;
 using System.Linq;
 using System.Threading.Tasks;
@@ -16,7 +15,7 @@ public class CorePackageService : ICorePackageService
         
         public CorePackageService(IEntityRepository<Package> packageRepository)
         {
-            _packageRepository = packageRepository;
+            _packageRepository = packageRepository ?? throw new ArgumentNullException(nameof(packageRepository));
         }
 
         public virtual async Task UpdatePackageStatusAsync(
diff --git a/src/NuGetGallery/App_Start/DefaultDependenciesModule.cs b/src/NuGetGallery/App_Start/DefaultDependenciesModule.cs
index 1fa9672f1e..e87013a425 100644
--- a/src/NuGetGallery/App_Start/DefaultDependenciesModule.cs
+++ b/src/NuGetGallery/App_Start/DefaultDependenciesModule.cs
@@ -17,6 +17,8 @@
 using Autofac.Core;
 using Elmah;
 using Microsoft.WindowsAzure.ServiceRuntime;
+using NuGet.Services.ServiceBus;
+using NuGet.Services.Validation;
 using NuGetGallery.Areas.Admin;
 using NuGetGallery.Areas.Admin.Models;
 using NuGetGallery.Auditing;
@@ -208,6 +210,11 @@ protected override void Load(ContainerBuilder builder)
                 .As<IPackageUploadService>()
                 .InstancePerLifetimeScope();
 
+            builder.RegisterType<ValidationService>()
+                .AsSelf()
+                .As<IValidationService>()
+                .InstancePerLifetimeScope();
+
             builder.RegisterType<ReadMeService>()
                 .AsSelf()
                 .As<IReadMeService>()
@@ -287,6 +294,8 @@ protected override void Load(ContainerBuilder builder)
                     break;
             }
 
+            RegisterAsynchronousValidation(builder, configuration);
+
             RegisterAuditingServices(builder, defaultAuditingService);
 
             RegisterCookieComplianceService(builder, configuration, diagnosticsService);
@@ -324,6 +333,38 @@ protected override void Load(ContainerBuilder builder)
             ConfigureAutocomplete(builder, configuration);
         }
 
+        private void RegisterAsynchronousValidation(ContainerBuilder builder, ConfigurationService configuration)
+        {
+            builder
+                .RegisterType<ServiceBusMessageSerializer>()
+                .As<IServiceBusMessageSerializer>();
+
+            builder
+                .RegisterType<PackageValidationEnqueuer>()
+                .As<IPackageValidationEnqueuer>();
+
+            if (configuration.Current.AsynchronousPackageValidationEnabled)
+            {
+                builder
+                    .RegisterType<AsynchronousPackageValidationInitiator>()
+                    .As<IPackageValidationInitiator>();
+
+                builder
+                    .Register(c => new TopicClientWrapper(
+                        configuration.ServiceBus.Validation_ConnectionString,
+                        configuration.ServiceBus.Validation_TopicName))
+                    .As<ITopicClient>()
+                    .SingleInstance()
+                    .OnRelease(x => x.Close());
+            }
+            else
+            {
+                builder
+                    .RegisterType<ImmediatePackageValidator>()
+                    .As<IPackageValidationInitiator>();
+            }
+        }
+
         private static void ConfigureSearch(ContainerBuilder builder, IGalleryConfigurationService configuration)
         {
             if (configuration.Current.ServiceDiscoveryUri == null)
diff --git a/src/NuGetGallery/Configuration/AppConfiguration.cs b/src/NuGetGallery/Configuration/AppConfiguration.cs
index 0ad9d2b62c..f844cbb430 100644
--- a/src/NuGetGallery/Configuration/AppConfiguration.cs
+++ b/src/NuGetGallery/Configuration/AppConfiguration.cs
@@ -63,6 +63,8 @@ public class AppConfiguration : IAppConfiguration
         /// </summary>
         public bool AzureStorageReadAccessGeoRedundant { get; set; }
 
+        public bool AsynchronousPackageValidationEnabled { get; set; }
+
         /// <summary>
         /// Gets the URI to the search service
         /// </summary>
diff --git a/src/NuGetGallery/Configuration/ConfigurationService.cs b/src/NuGetGallery/Configuration/ConfigurationService.cs
index 94968edbeb..f0ddd66ff2 100644
--- a/src/NuGetGallery/Configuration/ConfigurationService.cs
+++ b/src/NuGetGallery/Configuration/ConfigurationService.cs
@@ -21,22 +21,19 @@ public class ConfigurationService : PoliteCaptcha.IConfigurationSource, IGallery
     {
         protected const string SettingPrefix = "Gallery.";
         protected const string FeaturePrefix = "Feature.";
+        protected const string ServiceBusPrefix = "AzureServiceBus.";
         private bool _notInCloud;
         private readonly Lazy<string> _httpSiteRootThunk;
         private readonly Lazy<string> _httpsSiteRootThunk;
-        private ISecretReaderFactory _secretReaderFactory;
-        private Lazy<ISecretInjector> _secretInjector;
-        private Lazy<IAppConfiguration> _lazyAppConfiguration;
-        private Lazy<FeatureConfiguration> _lazyFeatureConfiguration;
+        private readonly ISecretReaderFactory _secretReaderFactory;
+        private readonly Lazy<ISecretInjector> _secretInjector;
+        private readonly Lazy<IAppConfiguration> _lazyAppConfiguration;
+        private readonly Lazy<FeatureConfiguration> _lazyFeatureConfiguration;
+        private readonly Lazy<IServiceBusConfiguration> _lazyServiceBusConfiguration;
 
         public ConfigurationService(ISecretReaderFactory secretReaderFactory)
         {
-            if (secretReaderFactory == null)
-            {
-                throw new ArgumentNullException(nameof(secretReaderFactory));
-            }
-
-            _secretReaderFactory = secretReaderFactory;
+            _secretReaderFactory = secretReaderFactory ?? throw new ArgumentNullException(nameof(secretReaderFactory));
             _secretInjector = new Lazy<ISecretInjector>(InitSecretInjector, isThreadSafe: false);
 
             _httpSiteRootThunk = new Lazy<string>(GetHttpSiteRoot);
@@ -44,6 +41,7 @@ public ConfigurationService(ISecretReaderFactory secretReaderFactory)
 
             _lazyAppConfiguration = new Lazy<IAppConfiguration>(() => ResolveSettings().Result);
             _lazyFeatureConfiguration = new Lazy<FeatureConfiguration>(() => ResolveFeatures().Result);
+            _lazyServiceBusConfiguration  = new Lazy<IServiceBusConfiguration>(() => ResolveServiceBus().Result);
         }
 
         public static IEnumerable<PropertyDescriptor> GetConfigProperties<T>(T instance)
@@ -65,6 +63,8 @@ public string GetConfigurationValue(string key)
 
         public FeatureConfiguration Features => _lazyFeatureConfiguration.Value;
 
+        public IServiceBusConfiguration ServiceBus => _lazyServiceBusConfiguration.Value;
+
         /// <summary>
         /// Gets the site root using the specified protocol
         /// </summary>
@@ -167,6 +167,11 @@ private async Task<IAppConfiguration> ResolveSettings()
             return await ResolveConfigObject(new AppConfiguration(), SettingPrefix);
         }
 
+        private async Task<IServiceBusConfiguration> ResolveServiceBus()
+        {
+            return await ResolveConfigObject(new ServiceBusConfiguration(), ServiceBusPrefix);
+        }
+
         protected virtual string GetCloudSetting(string settingName)
         {
             // Short-circuit if we've already determined we're not in the cloud
diff --git a/src/NuGetGallery/Configuration/IAppConfiguration.cs b/src/NuGetGallery/Configuration/IAppConfiguration.cs
index 175f09ceca..fa08a8cabe 100644
--- a/src/NuGetGallery/Configuration/IAppConfiguration.cs
+++ b/src/NuGetGallery/Configuration/IAppConfiguration.cs
@@ -80,6 +80,11 @@ public interface IAppConfiguration
         /// </summary>
         bool AzureStorageReadAccessGeoRedundant { get; set; }
 
+        /// <summary>
+        /// Gets a boolean indicating whether asynchronous package validation is enabled.
+        /// </summary>
+        bool AsynchronousPackageValidationEnabled { get; set; }
+
         /// <summary>
         /// Gets the URI to the search service
         /// </summary>
diff --git a/src/NuGetGallery/Configuration/IServiceBusConfiguration.cs b/src/NuGetGallery/Configuration/IServiceBusConfiguration.cs
new file mode 100644
index 0000000000..63b8471b2e
--- /dev/null
+++ b/src/NuGetGallery/Configuration/IServiceBusConfiguration.cs
@@ -0,0 +1,25 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+namespace NuGetGallery.Configuration
+{
+    /// <summary>
+    /// Configuration values related to Service Bus integration.
+    /// </summary>
+    public interface IServiceBusConfiguration
+    {
+        /// <summary>
+        /// The connection string to use when connecting to the validation topic. This connection string should not
+        /// contain the topic name as the name is explicitly specified by <see cref="Validation_TopicName"/>. This
+        /// connection string only needs to have the "Send" privilege. This topic is used for requesting asynchronous
+        /// validation of packages.
+        /// </summary>
+        string Validation_ConnectionString { get; set; }
+
+        /// <summary>
+        /// The name of the Azure Service Bus topic to send validation messages to. This topic name is used at the same
+        /// time as the <see cref="Validation_ConnectionString"/>.
+        /// </summary>
+        string Validation_TopicName { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Configuration/ServiceBusConfiguration.cs b/src/NuGetGallery/Configuration/ServiceBusConfiguration.cs
new file mode 100644
index 0000000000..0e620ce5fd
--- /dev/null
+++ b/src/NuGetGallery/Configuration/ServiceBusConfiguration.cs
@@ -0,0 +1,16 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.ComponentModel;
+
+namespace NuGetGallery.Configuration
+{
+    public class ServiceBusConfiguration : IServiceBusConfiguration
+    {
+        [DisplayName("Validation.ConnectionString")]
+        public string Validation_ConnectionString { get; set; }
+
+        [DisplayName("Validation.TopicName")]
+        public string Validation_TopicName { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Controllers/ApiController.cs b/src/NuGetGallery/Controllers/ApiController.cs
index 990e365498..30388ddb0b 100644
--- a/src/NuGetGallery/Controllers/ApiController.cs
+++ b/src/NuGetGallery/Controllers/ApiController.cs
@@ -482,8 +482,7 @@ await AuditingService.SaveAuditRecordAsync(
                             id,
                             packageToPush,
                             packageStreamMetadata,
-                            user,
-                            commitChanges: false);
+                            user);
 
                         await AutoCuratePackage.ExecuteAsync(package, packageToPush, commitChanges: false);
 
diff --git a/src/NuGetGallery/Controllers/PackagesController.cs b/src/NuGetGallery/Controllers/PackagesController.cs
index f0228b507b..4f4ed3aab0 100644
--- a/src/NuGetGallery/Controllers/PackagesController.cs
+++ b/src/NuGetGallery/Controllers/PackagesController.cs
@@ -1420,8 +1420,7 @@ public virtual async Task<JsonResult> VerifyPackage(VerifyPackageRequest formDat
                         packageMetadata.Id,
                         nugetPackage,
                         packageStreamMetadata,
-                        currentUser,
-                        commitChanges: false);
+                        currentUser);
 
                     Debug.Assert(package.PackageRegistration != null);
                 }
diff --git a/src/NuGetGallery/NuGetGallery.csproj b/src/NuGetGallery/NuGetGallery.csproj
index bfd47628cf..abcf1d9adb 100644
--- a/src/NuGetGallery/NuGetGallery.csproj
+++ b/src/NuGetGallery/NuGetGallery.csproj
@@ -365,6 +365,9 @@
       <HintPath>..\..\packages\Microsoft.Owin.Security.OpenIdConnect.3.0.1\lib\net45\Microsoft.Owin.Security.OpenIdConnect.dll</HintPath>
       <Private>True</Private>
     </Reference>
+    <Reference Include="Microsoft.ServiceBus, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\WindowsAzure.ServiceBus.4.1.3\lib\net45\Microsoft.ServiceBus.dll</HintPath>
+    </Reference>
     <Reference Include="Microsoft.Threading.Tasks, Version=1.0.12.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
       <HintPath>..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.dll</HintPath>
       <Private>True</Private>
@@ -442,6 +445,9 @@
     <Reference Include="NuGet.Protocol, Version=4.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
       <HintPath>..\..\packages\NuGet.Protocol.4.3.0-preview1-2524\lib\net45\NuGet.Protocol.dll</HintPath>
     </Reference>
+    <Reference Include="NuGet.Services.Contracts, Version=2.3.0.0, Culture=neutral, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\NuGet.Services.Contracts.2.3.0-dev-14813\lib\net45\NuGet.Services.Contracts.dll</HintPath>
+    </Reference>
     <Reference Include="NuGet.Services.KeyVault, Version=1.0.0.0, Culture=neutral, processorArchitecture=MSIL">
       <HintPath>..\..\packages\NuGet.Services.KeyVault.1.0.0.0\lib\net45\NuGet.Services.KeyVault.dll</HintPath>
       <Private>True</Private>
@@ -458,6 +464,12 @@
       <HintPath>..\..\packages\NuGet.Services.Platform.Client.3.0.29-r-master\lib\portable-net45+wp80+win\NuGet.Services.Platform.Client.dll</HintPath>
       <Private>True</Private>
     </Reference>
+    <Reference Include="NuGet.Services.ServiceBus, Version=2.3.0.0, Culture=neutral, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\NuGet.Services.ServiceBus.2.3.0-dev-14813\lib\net45\NuGet.Services.ServiceBus.dll</HintPath>
+    </Reference>
+    <Reference Include="NuGet.Services.Validation, Version=2.3.0.0, Culture=neutral, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\NuGet.Services.Validation.2.3.0-dev-14813\lib\net45\NuGet.Services.Validation.dll</HintPath>
+    </Reference>
     <Reference Include="NuGet.Versioning, Version=4.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
       <HintPath>..\..\packages\NuGet.Versioning.4.3.0-preview1-2524\lib\net45\NuGet.Versioning.dll</HintPath>
     </Reference>
@@ -707,10 +719,12 @@
     <Compile Include="Authentication\Providers\AzureActiveDirectory\AzureActiveDirectoryAuthenticator.cs" />
     <Compile Include="Authentication\Providers\AzureActiveDirectory\AzureActiveDirectoryAuthenticatorConfiguration.cs" />
     <Compile Include="Configuration\IGalleryConfigurationService.cs" />
+    <Compile Include="Configuration\IServiceBusConfiguration.cs" />
     <Compile Include="Configuration\SecretReader\CachingSecretReader.cs" />
     <Compile Include="Configuration\SecretReader\EmptySecretReaderFactory.cs" />
     <Compile Include="Configuration\SecretReader\ISecretReaderFactory.cs" />
     <Compile Include="Configuration\SecretReader\SecretReaderFactory.cs" />
+    <Compile Include="Configuration\ServiceBusConfiguration.cs" />
     <Compile Include="Configuration\StringArrayConverter.cs" />
     <Compile Include="Controllers\NuGetContext.cs" />
     <Compile Include="Diagnostics\ElmahHandleErrorAttribute.cs" />
@@ -755,6 +769,9 @@
     <Compile Include="GlobalSuppressions.cs" />
     <Compile Include="Helpers\GravatarHelper.cs" />
     <Compile Include="Helpers\RegexEx.cs" />
+    <Compile Include="Services\AsynchronousPackageValidationInitiator.cs" />
+    <Compile Include="Services\ImmediatePackageValidator.cs" />
+    <Compile Include="Services\IPackageValidationInitiator.cs" />
     <Compile Include="Infrastructure\HttpStatusCodeWithServerWarningResult.cs" />
     <Compile Include="Migrations\201704191802404_AddIndexPackageRegistrationKeySemVer.cs" />
     <Compile Include="Migrations\201704191802404_AddIndexPackageRegistrationKeySemVer.Designer.cs">
@@ -827,12 +844,14 @@
     <Compile Include="Security\UserSecurityPolicySubscriptionContext.cs" />
     <Compile Include="Services\IPackageOwnerRequestService.cs" />
     <Compile Include="Services\IReadMeService.cs" />
+    <Compile Include="Services\IValidationService.cs" />
     <Compile Include="Services\PackageOwnerRequestService.cs" />
     <Compile Include="Services\PackageUploadService.cs" />
     <Compile Include="Services\IReservedNamespaceService.cs" />
     <Compile Include="Services\IPackageUploadService.cs" />
     <Compile Include="Services\ReservedNamespaceService.cs" />
     <Compile Include="Services\ReadMeService.cs" />
+    <Compile Include="Services\ValidationService.cs" />
     <Compile Include="Telemetry\ClientInformationTelemetryEnricher.cs" />
     <Compile Include="Telemetry\QuietExceptionLogger.cs" />
     <Compile Include="Infrastructure\Authentication\CredentialBuilder.cs" />
@@ -1987,7 +2006,6 @@
     <Content Include="Content\font\fontawesome-webfont.woff" />
     <Content Include="Content\font\FontAwesome.otf" />
     <None Include="Properties\PublishProfiles\nuget-staging-frontend.pubxml" />
-    <Content Include="packages.config" />
     <Content Include="packages.config">
       <SubType>Designer</SubType>
     </Content>
diff --git a/src/NuGetGallery/Services/AsynchronousPackageValidationInitiator.cs b/src/NuGetGallery/Services/AsynchronousPackageValidationInitiator.cs
new file mode 100644
index 0000000000..d51a1276d1
--- /dev/null
+++ b/src/NuGetGallery/Services/AsynchronousPackageValidationInitiator.cs
@@ -0,0 +1,62 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Threading.Tasks;
+using NuGet.Services.Validation;
+using NuGetGallery.Configuration;
+using NuGetGallery.Diagnostics;
+
+namespace NuGetGallery
+{
+    /// <summary>
+    /// Initiates asynchronous validation on a package by enqueuing a message containing the package identity and a new
+    /// <see cref="Guid"/>. The <see cref="Guid"/> represents a unique validation request.
+    /// </summary>
+    public class AsynchronousPackageValidationInitiator : IPackageValidationInitiator
+    {
+        private readonly IPackageValidationEnqueuer _enqueuer;
+        private readonly IAppConfiguration _appConfiguration;
+        private readonly IDiagnosticsSource _diagnosticsSource;
+
+        public AsynchronousPackageValidationInitiator(
+            IPackageValidationEnqueuer enqueuer,
+            IAppConfiguration appConfiguration,
+            IDiagnosticsService diagnosticsService)
+        {
+            _enqueuer = enqueuer ?? throw new ArgumentNullException(nameof(enqueuer));
+            _appConfiguration = appConfiguration ?? throw new ArgumentNullException(nameof(appConfiguration));
+
+            if (diagnosticsService == null)
+            {
+                throw new ArgumentNullException(nameof(IDiagnosticsService));
+            }
+
+            _diagnosticsSource = diagnosticsService.SafeGetSource(nameof(AsynchronousPackageValidationInitiator));
+        }
+
+        public async Task<PackageStatus> StartValidationAsync(Package package)
+        {
+            if (_appConfiguration.ReadOnlyMode)
+            {
+                throw new ReadOnlyModeException(Strings.CannotEnqueueDueToReadOnly);
+            }
+
+            var data = new PackageValidationMessageData(
+                package.PackageRegistration.Id,
+                package.Version,
+                Guid.NewGuid());
+
+            var activityName = $"Enqueuing asynchronous package validation: " +
+                $"{data.PackageId} {data.PackageVersion} ({data.ValidationTrackingId})";
+            using (_diagnosticsSource.Activity(activityName))
+            {
+                await _enqueuer.StartValidationAsync(data);
+            }
+
+            // For now, don't require asynchronous validation before the package is available for consumption.
+            // Related: https://github.com/NuGet/NuGetGallery/issues/4744
+            return PackageStatus.Available;
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/IPackageService.cs b/src/NuGetGallery/Services/IPackageService.cs
index 95ca7a0450..4566f0d75e 100644
--- a/src/NuGetGallery/Services/IPackageService.cs
+++ b/src/NuGetGallery/Services/IPackageService.cs
@@ -34,7 +34,8 @@ public interface IPackageService : ICorePackageService
         IEnumerable<Package> FindDependentPackages(Package package);
 
         /// <summary>
-        /// Populate the related database tables to create the specified package for the specified user.
+        /// Populate the related database tables to create the specified package for the specified user. It is the
+        /// caller's responsibility to commit changes to the entity context.
         /// </summary>
         /// <remarks>
         /// This method doesn't upload the package binary to the blob storage. The caller must do it after this call.
@@ -43,9 +44,8 @@ public interface IPackageService : ICorePackageService
         /// <param name="packageStreamMetadata">The package stream's metadata.</param>
         /// <param name="user">The owner of the package</param>
         /// <param name="isVerified">Mark the package registration as verified or not</param>
-        /// <param name="commitChanges">Specifies whether to commit the changes to database.</param>
         /// <returns>The created package entity.</returns>
-        Task<Package> CreatePackageAsync(PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool isVerified, bool commitChanges = true);
+        Task<Package> CreatePackageAsync(PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool isVerified);
 
         Package EnrichPackageFromNuGetPackage(Package package, PackageArchiveReader packageArchive, PackageMetadata packageMetadata, PackageStreamMetadata packageStreamMetadata, User user);
 
diff --git a/src/NuGetGallery/Services/IPackageUploadService.cs b/src/NuGetGallery/Services/IPackageUploadService.cs
index bfb6d2b6b6..708139093e 100644
--- a/src/NuGetGallery/Services/IPackageUploadService.cs
+++ b/src/NuGetGallery/Services/IPackageUploadService.cs
@@ -9,6 +9,6 @@ namespace NuGetGallery
 {
     public interface IPackageUploadService
     {
-        Task<Package> GeneratePackageAsync(string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool commitChanges = true);
+        Task<Package> GeneratePackageAsync(string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user);
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/IPackageValidationInitiator.cs b/src/NuGetGallery/Services/IPackageValidationInitiator.cs
new file mode 100644
index 0000000000..96a9eeffb2
--- /dev/null
+++ b/src/NuGetGallery/Services/IPackageValidationInitiator.cs
@@ -0,0 +1,25 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Threading.Tasks;
+
+namespace NuGetGallery
+{
+    /// <summary>
+    /// Initiates validation for a specific package.
+    /// </summary>
+    public interface IPackageValidationInitiator
+    {
+        /// <summary>
+        /// Starts the validation for the specified package. The validation can be done asynchronously with respect
+        /// to the gallery and therefore may not be complete when the returned <see cref="Task"/> completes. This
+        /// pending validation state is indicated by the package having the <see cref="PackageStatus.Validating"/>
+        /// status.
+        /// </summary>
+        /// <param name="package">The package to initiate validation for.</param>
+        /// <returns>
+        /// The task which signals the completion of the validation initiation. The result of the <see cref="Task"/>
+        /// is the <see cref="PackageStatus"/> that should be applied to the package.</returns>
+        Task<PackageStatus> StartValidationAsync(Package package);
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/IReservedNamespaceService.cs b/src/NuGetGallery/Services/IReservedNamespaceService.cs
index f89df89658..a7743b981a 100644
--- a/src/NuGetGallery/Services/IReservedNamespaceService.cs
+++ b/src/NuGetGallery/Services/IReservedNamespaceService.cs
@@ -45,13 +45,13 @@ public interface IReservedNamespaceService
         Task DeleteOwnerFromReservedNamespaceAsync(string prefix, string username);
 
         /// <summary>
-        /// Add the specified package registration to the reserved namespace
+        /// Add the specified package registration to the reserved namespace. It is the caller's reponsibility to
+        /// commit the changes to the database.
         /// </summary>
         /// <param name="prefix">The reserved namespace to modify</param>
         /// <param name="packageRegistration">The package registration to be added</param>
-        /// <param name="commitChanges">Commit changes to the database, defaults to true</param>
         /// <returns>Awaitable Task</returns>
-        Task AddPackageRegistrationToNamespaceAsync(string prefix, PackageRegistration packageRegistration, bool commitChanges = true);
+        void AddPackageRegistrationToNamespace(string prefix, PackageRegistration packageRegistration);
 
         /// <summary>
         /// Retrieves the first reserved namespace which matches the given prefix.
diff --git a/src/NuGetGallery/Services/IValidationService.cs b/src/NuGetGallery/Services/IValidationService.cs
new file mode 100644
index 0000000000..58fcbc6d12
--- /dev/null
+++ b/src/NuGetGallery/Services/IValidationService.cs
@@ -0,0 +1,20 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Threading.Tasks;
+
+namespace NuGetGallery
+{
+    /// <summary>
+    /// The service for interacting with the asynchronous validation pipeline.
+    /// </summary>
+    public interface IValidationService
+    {
+        /// <summary>
+        /// Starts the asynchronous validation for the provided package and puts the package in the correct state. The
+        /// commit to the database is the responsibility of the caller.
+        /// </summary>
+        /// <param name="package">The package to start validation for.</param>
+        Task StartValidationAsync(Package package);
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/ImmediatePackageValidator.cs b/src/NuGetGallery/Services/ImmediatePackageValidator.cs
new file mode 100644
index 0000000000..642ca743e4
--- /dev/null
+++ b/src/NuGetGallery/Services/ImmediatePackageValidator.cs
@@ -0,0 +1,19 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Threading.Tasks;
+
+namespace NuGetGallery
+{
+    /// <summary>
+    /// A validation initiator that immediately marks the package as validated. In other words, no asynchronous
+    /// validation is performed by this implementation.
+    /// </summary>
+    public class ImmediatePackageValidator : IPackageValidationInitiator
+    {
+        public Task<PackageStatus> StartValidationAsync(Package package)
+        {
+            return Task.FromResult(PackageStatus.Available);
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/PackageService.cs b/src/NuGetGallery/Services/PackageService.cs
index ea1d6933eb..981445f4f7 100644
--- a/src/NuGetGallery/Services/PackageService.cs
+++ b/src/NuGetGallery/Services/PackageService.cs
@@ -17,7 +17,6 @@ namespace NuGetGallery
 {
     public class PackageService : CorePackageService, IPackageService
     {
-        private readonly IIndexingService _indexingService;
         private readonly IEntityRepository<PackageRegistration> _packageRegistrationRepository;
         private readonly IPackageOwnerRequestService _packageOwnerRequestService;
         private readonly IPackageNamingConflictValidator _packageNamingConflictValidator;
@@ -27,45 +26,13 @@ public PackageService(
             IEntityRepository<PackageRegistration> packageRegistrationRepository,
             IEntityRepository<Package> packageRepository,
             IPackageOwnerRequestService packageOwnerRequestService,
-            IIndexingService indexingService,
             IPackageNamingConflictValidator packageNamingConflictValidator,
             IAuditingService auditingService) : base(packageRepository)
         {
-            if (packageRegistrationRepository == null)
-            {
-                throw new ArgumentNullException(nameof(packageRegistrationRepository));
-            }
-
-            if (packageRepository == null)
-            {
-                throw new ArgumentNullException(nameof(packageRepository));
-            }
-
-            if (packageOwnerRequestService == null)
-            {
-                throw new ArgumentNullException(nameof(packageOwnerRequestService));
-            }
-
-            if (indexingService == null)
-            {
-                throw new ArgumentNullException(nameof(indexingService));
-            }
-
-            if (packageNamingConflictValidator == null)
-            {
-                throw new ArgumentNullException(nameof(packageNamingConflictValidator));
-            }
-
-            if (auditingService == null)
-            {
-                throw new ArgumentNullException(nameof(auditingService));
-            }
-
-            _packageRegistrationRepository = packageRegistrationRepository;
-            _packageOwnerRequestService = packageOwnerRequestService;
-            _indexingService = indexingService;
-            _packageNamingConflictValidator = packageNamingConflictValidator;
-            _auditingService = auditingService;
+            _packageRegistrationRepository = packageRegistrationRepository ?? throw new ArgumentNullException(nameof(packageRegistrationRepository));
+            _packageOwnerRequestService = packageOwnerRequestService ?? throw new ArgumentNullException(nameof(packageOwnerRequestService));
+            _packageNamingConflictValidator = packageNamingConflictValidator ?? throw new ArgumentNullException(nameof(packageNamingConflictValidator));
+            _auditingService = auditingService ?? throw new ArgumentNullException(nameof(auditingService));
         }
 
         /// <summary>
@@ -111,7 +78,7 @@ public void EnsureValid(PackageArchiveReader packageArchiveReader)
         /// <exception cref="InvalidPackageException">
         /// This exception will be thrown when a package metadata property violates a data validation constraint.
         /// </exception>
-        public async Task<Package> CreatePackageAsync(PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool isVerified, bool commitChanges = true)
+        public async Task<Package> CreatePackageAsync(PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool isVerified)
         {
             PackageMetadata packageMetadata;
             PackageRegistration packageRegistration;
@@ -136,12 +103,6 @@ public async Task<Package> CreatePackageAsync(PackageArchiveReader nugetPackage,
             packageRegistration.Packages.Add(package);
             await UpdateIsLatestAsync(packageRegistration, commitChanges: false);
 
-            if (commitChanges)
-            {
-                await _packageRegistrationRepository.CommitChangesAsync();
-                NotifyIndexingService();
-            }
-
             return package;
         }
 
@@ -738,11 +699,6 @@ private void ValidatePackageTitle(PackageMetadata packageMetadata)
                 throw new EntityException(Strings.TitleMatchesExistingRegistration, packageMetadata.Title);
             }
         }
-        
-        private void NotifyIndexingService()
-        {
-            _indexingService.UpdateIndex();
-        }
 
         public async Task SetLicenseReportVisibilityAsync(Package package, bool visible, bool commitChanges = true)
         {
diff --git a/src/NuGetGallery/Services/PackageUploadService.cs b/src/NuGetGallery/Services/PackageUploadService.cs
index cc69040217..adce79f87a 100644
--- a/src/NuGetGallery/Services/PackageUploadService.cs
+++ b/src/NuGetGallery/Services/PackageUploadService.cs
@@ -1,44 +1,52 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
+using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
-using System.Collections.Generic;
 using NuGet.Packaging;
 using NuGetGallery.Packaging;
 
 namespace NuGetGallery
 {
-    public class PackageUploadService: IPackageUploadService
+    public class PackageUploadService : IPackageUploadService
     {
         private readonly IPackageService _packageService;
         private readonly IReservedNamespaceService _reservedNamespaceService;
+        private readonly IValidationService _validationService;
 
         public PackageUploadService(
             IPackageService packageService,
-            IReservedNamespaceService reservedNamespaceService)
+            IReservedNamespaceService reservedNamespaceService,
+            IValidationService validationService)
         {
             _packageService = packageService;
             _reservedNamespaceService = reservedNamespaceService;
+            _validationService = validationService;
         }
 
-        public async Task<Package> GeneratePackageAsync(string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool commitChanges)
+        public async Task<Package> GeneratePackageAsync(string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user)
         {
             var isPushAllowed = _reservedNamespaceService.IsPushAllowed(id, user, out IReadOnlyCollection<ReservedNamespace> userOwnedNamespaces);
-
             var shouldMarkIdVerified = isPushAllowed && userOwnedNamespaces != null && userOwnedNamespaces.Any();
+
             var package = await _packageService.CreatePackageAsync(
                 nugetPackage,
                 packageStreamMetadata,
                 user,
-                isVerified: shouldMarkIdVerified,
-                commitChanges: commitChanges);
+                isVerified: shouldMarkIdVerified);
+
+            await _validationService.StartValidationAsync(package);
 
             if (shouldMarkIdVerified)
             {
                 // Add all relevant package registrations to the applicable namespaces
-                await Task.WhenAll(userOwnedNamespaces
-                    .Select(rn => _reservedNamespaceService.AddPackageRegistrationToNamespaceAsync(rn.Value, package.PackageRegistration, commitChanges)));
+                foreach (var rn in userOwnedNamespaces)
+                {
+                    _reservedNamespaceService.AddPackageRegistrationToNamespace(
+                        rn.Value,
+                        package.PackageRegistration);
+                }
             }
 
             return package;
diff --git a/src/NuGetGallery/Services/ReservedNamespaceService.cs b/src/NuGetGallery/Services/ReservedNamespaceService.cs
index 9d58be2a11..8036121605 100644
--- a/src/NuGetGallery/Services/ReservedNamespaceService.cs
+++ b/src/NuGetGallery/Services/ReservedNamespaceService.cs
@@ -224,14 +224,13 @@ public async Task DeleteOwnerFromReservedNamespaceAsync(string prefix, string us
         /// <summary>
         /// This method fetches the reserved namespace matching the prefix and adds the 
         /// package registration entry to the reserved namespace, the provided package registration
-        /// should be an entry in the database or an entity from memory to be committed.
+        /// should be an entry in the database or an entity from memory to be committed. It is the caller's
+        /// responsibility to commit the changes to the entity context.
         /// </summary>
         /// <param name="prefix">The prefix value of the reserved namespace to modify</param>
         /// <param name="packageRegistration">The package registration entity entry to be added.</param>
-        /// <param name="commitChanges">Flag to commit the modifications to the database, if set to false
-        /// the caller of this method should take care of saving changes for entities context.</param>
         /// <returns>Awaitable task</returns>
-        public async Task AddPackageRegistrationToNamespaceAsync(string prefix, PackageRegistration packageRegistration, bool commitChanges = true)
+        public void AddPackageRegistrationToNamespace(string prefix, PackageRegistration packageRegistration)
         {
             if (string.IsNullOrWhiteSpace(prefix))
             {
@@ -248,11 +247,6 @@ public async Task AddPackageRegistrationToNamespaceAsync(string prefix, PackageR
                     CultureInfo.CurrentCulture, Strings.ReservedNamespace_NamespaceNotFound, prefix));
 
             namespaceToModify.PackageRegistrations.Add(packageRegistration);
-
-            if (commitChanges)
-            {
-                await ReservedNamespaceRepository.CommitChangesAsync();
-            }
         }
 
         public virtual ReservedNamespace FindReservedNamespaceForPrefix(string prefix)
diff --git a/src/NuGetGallery/Services/ValidationService.cs b/src/NuGetGallery/Services/ValidationService.cs
new file mode 100644
index 0000000000..edcb5106b4
--- /dev/null
+++ b/src/NuGetGallery/Services/ValidationService.cs
@@ -0,0 +1,32 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Threading.Tasks;
+
+namespace NuGetGallery
+{
+    public class ValidationService : IValidationService
+    {
+        private readonly IPackageService _packageService;
+        private readonly IPackageValidationInitiator _initiator;
+
+        public ValidationService(
+            IPackageService packageService,
+            IPackageValidationInitiator initiator)
+        {
+            _packageService = packageService ?? throw new ArgumentNullException(nameof(packageService));
+            _initiator = initiator ?? throw new ArgumentNullException(nameof(initiator));
+        }
+
+        public async Task StartValidationAsync(Package package)
+        {
+            var packageStatus = await _initiator.StartValidationAsync(package);
+
+            await _packageService.UpdatePackageStatusAsync(
+                package,
+                packageStatus,
+                commitChanges: false);
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Strings.Designer.cs b/src/NuGetGallery/Strings.Designer.cs
index 2e872c21f8..8c525c3b2e 100644
--- a/src/NuGetGallery/Strings.Designer.cs
+++ b/src/NuGetGallery/Strings.Designer.cs
@@ -324,6 +324,15 @@ public static string CancelEmailAddress {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Enqueuing unavailable: the gallery is currently in read only mode, with limited service. Please try again later..
+        /// </summary>
+        public static string CannotEnqueueDueToReadOnly {
+            get {
+                return ResourceManager.GetString("CannotEnqueueDueToReadOnly", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Oops! You can&apos;t remove the only credential that can be used to sign in to the website!.
         /// </summary>
diff --git a/src/NuGetGallery/Strings.resx b/src/NuGetGallery/Strings.resx
index 92f24a8e5b..58ac6911b5 100644
--- a/src/NuGetGallery/Strings.resx
+++ b/src/NuGetGallery/Strings.resx
@@ -562,7 +562,7 @@ For more information, please contact '{2}'.</value>
     <value>User not found with username '{0}'</value>
   </data>
   <data name="ReservedNamespace_ReservedIndicatorTooltip" xml:space="preserve">
-    <value>The ID prefix of this package has been reserved for one of the owners of this package by NuGet.org.</value>
+    <value>The ID prefix of this package has been reserved for one of the owner of this package by NuGet.org.</value>
   </data>
   <data name="UploadPackage_IdNamespaceConflict" xml:space="preserve">
     <value>This package ID has been reserved. Please request access to upload to this reserved namespace from the owner of the reserved prefix, or re-upload the package with a different ID.</value>
@@ -600,4 +600,7 @@ For more information, please contact '{2}'.</value>
   <data name="ReservedNamespace_UserAlreadyOwner" xml:space="preserve">
     <value>The user '{0}' is already an owner of the specified namespace.</value>
   </data>
+  <data name="CannotEnqueueDueToReadOnly" xml:space="preserve">
+    <value>Enqueuing unavailable: the gallery is currently in read only mode, with limited service. Please try again later.</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/src/NuGetGallery/Web.config b/src/NuGetGallery/Web.config
index 2e7bf6e8a7..e04a4bbf45 100644
--- a/src/NuGetGallery/Web.config
+++ b/src/NuGetGallery/Web.config
@@ -38,6 +38,15 @@
     
     <add key="Gallery.AzureStorageReadAccessGeoRedundant" value="false" />
     <!-- If the storage account has to fall-back to a secondary (when Read Access Geo Redundant is enabled in Azure storage), change Gallery.AzureStorageReadAccessGeoRedundant to true -->
+
+    <add key="Gallery.AsynchronousPackageValidationEnabled" value="false" />
+    
+    <add key="AzureServiceBus.Validation.ConnectionString" value="" />
+    <add key="AzureServiceBus.Validation.TopicName" value="" />
+    <!--
+    If Gallery.AsynchronousPackageValidationEnabled is true, both the AzureServiceBus.Validation.ConnectionString
+    and AzureServiceBus.Validation.TopicName must be set.
+    -->
     
     <!-- ******************** -->
     <!-- ENVIRONMENT SPECIFIC -->
@@ -552,6 +561,30 @@
   </runtime>
   <system.serviceModel>
     <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
+    <extensions>
+      <!-- Azure Service Bus extensions, added automatically by the WindowsAzure.ServiceBus package. -->
+      <behaviorExtensions>
+        <add name="connectionStatusBehavior" type="Microsoft.ServiceBus.Configuration.ConnectionStatusElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="transportClientEndpointBehavior" type="Microsoft.ServiceBus.Configuration.TransportClientEndpointBehaviorElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="serviceRegistrySettings" type="Microsoft.ServiceBus.Configuration.ServiceRegistrySettingsElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+      </behaviorExtensions>
+      <bindingElementExtensions>
+        <add name="netMessagingTransport" type="Microsoft.ServiceBus.Messaging.Configuration.NetMessagingTransportExtensionElement, Microsoft.ServiceBus,  Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="tcpRelayTransport" type="Microsoft.ServiceBus.Configuration.TcpRelayTransportElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="httpRelayTransport" type="Microsoft.ServiceBus.Configuration.HttpRelayTransportElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="httpsRelayTransport" type="Microsoft.ServiceBus.Configuration.HttpsRelayTransportElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="onewayRelayTransport" type="Microsoft.ServiceBus.Configuration.RelayedOnewayTransportElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+      </bindingElementExtensions>
+      <bindingExtensions>
+        <add name="basicHttpRelayBinding" type="Microsoft.ServiceBus.Configuration.BasicHttpRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="webHttpRelayBinding" type="Microsoft.ServiceBus.Configuration.WebHttpRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="ws2007HttpRelayBinding" type="Microsoft.ServiceBus.Configuration.WS2007HttpRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="netTcpRelayBinding" type="Microsoft.ServiceBus.Configuration.NetTcpRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="netOnewayRelayBinding" type="Microsoft.ServiceBus.Configuration.NetOnewayRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="netEventRelayBinding" type="Microsoft.ServiceBus.Configuration.NetEventRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="netMessagingBinding" type="Microsoft.ServiceBus.Messaging.Configuration.NetMessagingBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+      </bindingExtensions>
+    </extensions>
   </system.serviceModel>
   <entityFramework>
     <defaultConnectionFactory type="System.Data.Entity.Infrastructure.SqlConnectionFactory, EntityFramework">
diff --git a/src/NuGetGallery/packages.config b/src/NuGetGallery/packages.config
index 78ea942e9b..54479ab22d 100644
--- a/src/NuGetGallery/packages.config
+++ b/src/NuGetGallery/packages.config
@@ -89,10 +89,13 @@
   <package id="NuGet.Packaging" version="4.3.0-preview1-2524" targetFramework="net46" />
   <package id="NuGet.Packaging.Core" version="4.3.0-preview1-2524" targetFramework="net46" />
   <package id="NuGet.Protocol" version="4.3.0-preview1-2524" targetFramework="net46" />
+  <package id="NuGet.Services.Contracts" version="2.3.0-dev-14813" targetFramework="net46" />
   <package id="NuGet.Services.KeyVault" version="1.0.0.0" targetFramework="net46" />
   <package id="NuGet.Services.Logging" version="2.2.3.0" targetFramework="net46" />
   <package id="NuGet.Services.Owin" version="2.2.3" targetFramework="net46" />
   <package id="NuGet.Services.Platform.Client" version="3.0.29-r-master" targetFramework="net46" />
+  <package id="NuGet.Services.ServiceBus" version="2.3.0-dev-14813" targetFramework="net46" />
+  <package id="NuGet.Services.Validation" version="2.3.0-dev-14813" targetFramework="net46" />
   <package id="NuGet.Versioning" version="4.3.0-preview1-2524" targetFramework="net46" />
   <package id="ODataNullPropagationVisitor" version="0.5.4237.2641" targetFramework="net46" />
   <package id="Owin" version="1.0" targetFramework="net46" />
@@ -147,5 +150,6 @@
   <package id="WebBackgrounder.EntityFramework" version="0.1" targetFramework="net46" />
   <package id="WebGrease" version="1.1.0" targetFramework="net46" />
   <package id="WindowsAzure.Caching" version="1.7.0.0" targetFramework="net46" />
+  <package id="WindowsAzure.ServiceBus" version="4.1.3" targetFramework="net46" />
   <package id="WindowsAzure.Storage" version="7.0.0" targetFramework="net46" />
 </packages>
\ No newline at end of file
diff --git a/tests/NuGetGallery.Facts/App.config b/tests/NuGetGallery.Facts/App.config
index e2641edaaf..ae6ca3f786 100644
--- a/tests/NuGetGallery.Facts/App.config
+++ b/tests/NuGetGallery.Facts/App.config
@@ -131,4 +131,30 @@
       <provider invariantName="System.Data.SqlClient" type="System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer" />
     </providers>
   </entityFramework>
+  <system.serviceModel>
+    <extensions>
+      <!-- In this extension section we are introducing all known service bus extensions. User can remove the ones they don't need. -->
+      <behaviorExtensions>
+        <add name="connectionStatusBehavior" type="Microsoft.ServiceBus.Configuration.ConnectionStatusElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="transportClientEndpointBehavior" type="Microsoft.ServiceBus.Configuration.TransportClientEndpointBehaviorElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="serviceRegistrySettings" type="Microsoft.ServiceBus.Configuration.ServiceRegistrySettingsElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+      </behaviorExtensions>
+      <bindingElementExtensions>
+        <add name="netMessagingTransport" type="Microsoft.ServiceBus.Messaging.Configuration.NetMessagingTransportExtensionElement, Microsoft.ServiceBus,  Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="tcpRelayTransport" type="Microsoft.ServiceBus.Configuration.TcpRelayTransportElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="httpRelayTransport" type="Microsoft.ServiceBus.Configuration.HttpRelayTransportElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="httpsRelayTransport" type="Microsoft.ServiceBus.Configuration.HttpsRelayTransportElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="onewayRelayTransport" type="Microsoft.ServiceBus.Configuration.RelayedOnewayTransportElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+      </bindingElementExtensions>
+      <bindingExtensions>
+        <add name="basicHttpRelayBinding" type="Microsoft.ServiceBus.Configuration.BasicHttpRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="webHttpRelayBinding" type="Microsoft.ServiceBus.Configuration.WebHttpRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="ws2007HttpRelayBinding" type="Microsoft.ServiceBus.Configuration.WS2007HttpRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="netTcpRelayBinding" type="Microsoft.ServiceBus.Configuration.NetTcpRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="netOnewayRelayBinding" type="Microsoft.ServiceBus.Configuration.NetOnewayRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="netEventRelayBinding" type="Microsoft.ServiceBus.Configuration.NetEventRelayBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+        <add name="netMessagingBinding" type="Microsoft.ServiceBus.Messaging.Configuration.NetMessagingBindingCollectionElement, Microsoft.ServiceBus, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
+      </bindingExtensions>
+    </extensions>
+  </system.serviceModel>
 </configuration>
\ No newline at end of file
diff --git a/tests/NuGetGallery.Facts/Controllers/ApiControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/ApiControllerFacts.cs
index e504e0d143..6c9a683373 100644
--- a/tests/NuGetGallery.Facts/Controllers/ApiControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/ApiControllerFacts.cs
@@ -82,8 +82,8 @@ public TestableApiController(
             MockTelemetryService = new Mock<ITelemetryService>();
             TelemetryService = MockTelemetryService.Object;
 
-            MockPackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>())).
-                Returns((PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool isVerified, bool commitChanges) =>
+            MockPackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>())).
+                Returns((PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool isVerified) =>
                 {
                     var packageMetadata = PackageMetadata.FromNuspecReader(nugetPackage.GetNuspecReader());
 
@@ -103,9 +103,9 @@ public TestableApiController(
                 .Setup(r => r.IsPushAllowed(It.IsAny<string>(), It.IsAny<User>(), out matchingNamespaces))
                 .Returns(true);
 
-            MockPackageUploadService.Setup(x => x.GeneratePackageAsync(It.IsAny<string>(), It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
-                .Returns((string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool commitChanges) => {
-                    return MockPackageService.Object.CreatePackageAsync(nugetPackage, packageStreamMetadata, user, isVerified: false, commitChanges: commitChanges);
+            MockPackageUploadService.Setup(x => x.GeneratePackageAsync(It.IsAny<string>(), It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>()))
+                .Returns((string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user) => {
+                    return MockPackageService.Object.CreatePackageAsync(nugetPackage, packageStreamMetadata, user, isVerified: false);
                 });
 
             var requestMock = new Mock<HttpRequestBase>();
@@ -171,7 +171,7 @@ public async Task CreatePackageWillSavePackageFileToFileStorage()
                     .Returns(Task.CompletedTask).Verifiable();
                 controller.MockPackageService.Setup(p => p.FindPackageRegistrationById(It.IsAny<string>()))
                     .Returns(packageRegistration);
-                controller.MockPackageService.Setup(p => p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false))
+                controller.MockPackageService.Setup(p => p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                     .Returns(Task.FromResult(package));
 
                 var nuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.42");
@@ -214,7 +214,7 @@ public async Task WillDeletePackageFileFromBlobStorageIfSavingDbChangesFails()
                 controller.MockPackageService.Setup(
                         p =>
                             p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(),
-                                It.IsAny<User>(), It.IsAny<bool>(), false))
+                                It.IsAny<User>(), It.IsAny<bool>()))
                     .Returns(Task.FromResult(package));
                 controller.MockEntitiesContext.Setup(e => e.SaveChangesAsync()).Throws<Exception>();
 
@@ -243,7 +243,7 @@ public async Task WritesAnAuditRecord()
 
                 var controller = new TestableApiController(GetConfigurationService());
                 controller.SetCurrentUser(user);
-                controller.MockPackageService.Setup(p => p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false))
+                controller.MockPackageService.Setup(p => p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                     .Returns(Task.FromResult(package));
 
                 var nuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.42");
@@ -276,7 +276,7 @@ public async Task CreatePackageWillSendPackageAddedNotice()
                 controller.SetCurrentUser(user);
                 controller.MockMessageService.Setup(p => p.SendPackageAddedNotice(package, It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()))
                     .Verifiable();
-                controller.MockPackageService.Setup(p => p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false))
+                controller.MockPackageService.Setup(p => p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                     .Returns(Task.FromResult(package));
 
                 var nuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.42");
@@ -538,7 +538,7 @@ public async Task WillCreateAPackageFromTheNuGetPackage()
 
                 await controller.CreatePackagePut();
 
-                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false));
+                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
                 controller.MockEntitiesContext.VerifyCommitted();
             }
 
@@ -574,7 +574,7 @@ public async Task WillCreatePackageIfIdMatchesSharedNamespace()
                 var result = await controller.CreatePackagePut();
 
                 // Assert
-                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false));
+                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
                 controller.MockEntitiesContext.VerifyCommitted();
             }
 
@@ -609,7 +609,7 @@ public async Task WillCreatePackageIfIdMatchesAnOwnedNamespace()
                 var result = await controller.CreatePackagePut();
 
                 // Assert
-                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false));
+                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
                 controller.MockEntitiesContext.VerifyCommitted();
             }
 
@@ -672,7 +672,7 @@ public async Task WillCreateAPackageWithTheUserMatchingTheApiKey()
 
                 await controller.CreatePackagePut();
 
-                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user, It.IsAny<bool>(), false));
+                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user, It.IsAny<bool>()));
                 controller.MockEntitiesContext.VerifyCommitted();
             }
 
@@ -698,7 +698,7 @@ public async Task WillVerifyScopesForNewPackageId(string apiKeyScopes, bool isPu
                 controller.MockPackageService.Setup(
                     x =>
                         x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user,
-                            It.IsAny<bool>(), It.IsAny<bool>())).Returns(Task.FromResult(package));
+                            It.IsAny<bool>())).Returns(Task.FromResult(package));
 
                 // Act
                 var result = await controller.CreatePackagePut();
@@ -707,7 +707,7 @@ public async Task WillVerifyScopesForNewPackageId(string apiKeyScopes, bool isPu
                 if (isPushAllowed)
                 {
                     controller.MockPackageService.Verify(
-                        x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user, It.IsAny<bool>(), false));
+                        x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user, It.IsAny<bool>()));
                     controller.MockEntitiesContext.VerifyCommitted();
                 }
                 else
@@ -717,7 +717,6 @@ public async Task WillVerifyScopesForNewPackageId(string apiKeyScopes, bool isPu
                             It.IsAny<PackageArchiveReader>(),
                             It.IsAny<PackageStreamMetadata>(),
                             It.IsAny<User>(),
-                            It.IsAny<bool>(),
                             It.IsAny<bool>()),
                         Times.Never);
 
@@ -758,7 +757,7 @@ public async Task WillVerifyScopesForExistingPackageId(string apiKeyScopes, bool
                 controller.MockPackageService.Setup(
                     x =>
                         x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user,
-                            It.IsAny<bool>(), It.IsAny<bool>())).Returns(Task.FromResult(package));
+                            It.IsAny<bool>())).Returns(Task.FromResult(package));
 
                 // Act
                 var result = await controller.CreatePackagePut();
@@ -767,7 +766,7 @@ public async Task WillVerifyScopesForExistingPackageId(string apiKeyScopes, bool
                 if (isPushAllowed)
                 {
                     controller.MockPackageService.Verify(
-                        x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user, It.IsAny<bool>(), false));
+                        x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user, It.IsAny<bool>()));
                     controller.MockEntitiesContext.VerifyCommitted();
                 }
                 else
@@ -777,7 +776,6 @@ public async Task WillVerifyScopesForExistingPackageId(string apiKeyScopes, bool
                             It.IsAny<PackageArchiveReader>(),
                             It.IsAny<PackageStreamMetadata>(),
                             It.IsAny<User>(),
-                            It.IsAny<bool>(),
                             It.IsAny<bool>()),
                         Times.Never);
 
diff --git a/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
index 685da310be..d86b45e984 100644
--- a/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
@@ -103,10 +103,10 @@ private static PackagesController CreateController(
 
             packageUploadService = packageUploadService ?? new Mock<IPackageUploadService>();
 
-            packageUploadService.Setup(x => x.GeneratePackageAsync(It.IsAny<string>(), It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
-                .Returns((string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool commitChanges) =>
+            packageUploadService.Setup(x => x.GeneratePackageAsync(It.IsAny<string>(), It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>()))
+                .Returns((string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user) =>
                 {
-                    return packageService.Object.CreatePackageAsync(nugetPackage, packageStreamMetadata, user, isVerified: false, commitChanges: commitChanges);
+                    return packageService.Object.CreatePackageAsync(nugetPackage, packageStreamMetadata, user, isVerified: false);
                 });
 
             var controller = new Mock<PackagesController>(
@@ -2105,7 +2105,7 @@ public async Task WillCreateThePackage()
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>())).Returns(
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>())).Returns(
                         Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2118,7 +2118,7 @@ public async Task WillCreateThePackage()
 
                     await controller.VerifyPackage(new VerifyPackageRequest() { Listed = true, Edit = null });
 
-                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false));
+                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
                 }
             }
 
@@ -2133,7 +2133,7 @@ public async Task WillSavePackageToFileStorage()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2152,7 +2152,7 @@ public async Task WillSavePackageToFileStorage()
                     await controller.VerifyPackage(new VerifyPackageRequest() { Listed = true, Edit = null });
 
                     // Assert
-                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false));
+                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
                     fakePackageFileService.Verify();
                 }
             }
@@ -2170,7 +2170,7 @@ public async Task WillDeletePackageFileFromBlobStorageIfSavingDbChangesFails()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = packageId }, Version = packageVersion };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream(packageId, packageVersion);
 
@@ -2194,7 +2194,7 @@ public async Task WillDeletePackageFileFromBlobStorageIfSavingDbChangesFails()
                     await Assert.ThrowsAsync<Exception>(async () => await controller.VerifyPackage(new VerifyPackageRequest() { Listed = true, Edit = null }));
 
                     // Assert
-                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false));
+                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
                     fakePackageFileService.Verify();
                 }
             }
@@ -2210,7 +2210,7 @@ public async Task WillShowViewWithMessageIfSavingPackageBlobFails()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2233,7 +2233,7 @@ public async Task WillShowViewWithMessageIfSavingPackageBlobFails()
                     await controller.VerifyPackage(new VerifyPackageRequest() { Listed = true, Edit = null });
 
                     // Assert
-                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false));
+                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
                     Assert.Equal(Strings.UploadPackage_IdVersionConflict, controller.TempData["Message"]);
                     fakeEntitiesContext.VerifyCommitted(Times.Never());
                 }
@@ -2250,7 +2250,7 @@ public async Task WillUpdateIndexingService()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
                     var fakePackageFileService = new Mock<IPackageFileService>();
@@ -2289,7 +2289,7 @@ public async Task WillSaveChangesToEntitiesContext()
                         .Returns(Task.CompletedTask);
                     var fakePackageService = new Mock<IPackageService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2326,7 +2326,7 @@ public async Task WillNotCommitChangesToPackageService()
                         .Returns(Task.CompletedTask);
                     var fakePackageService = new Mock<IPackageService>(MockBehavior.Strict);
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), false))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
                     fakePackageService.Setup(x => x.PublishPackageAsync(fakePackage, false))
                         .Returns(Task.CompletedTask);
@@ -2359,7 +2359,7 @@ public async Task WillPublishThePackage()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
                     var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2385,7 +2385,7 @@ public async Task WillMarkThePackageUnlistedWhenListedArgumentIsFalse()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2414,7 +2414,7 @@ public async Task WillNotMarkThePackageUnlistedWhenListedArgumentIsNullorTrue(bo
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2440,7 +2440,7 @@ public async Task WillDeleteTheUploadFile()
                 {
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2467,7 +2467,7 @@ public async Task WillSetAFlashMessage()
                     fakeUploadFileService.Setup(x => x.SaveUploadFileAsync(TestUtility.FakeUser.Key, It.IsAny<Stream>())).Returns(Task.FromResult(0));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2493,7 +2493,7 @@ public async Task WillRedirectToPackagePage()
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2525,7 +2525,7 @@ public async Task WillCurateThePackage()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2555,7 +2555,7 @@ public async Task WritesAnAuditRecord()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2591,7 +2591,7 @@ public async Task WillSendPackagePublishedEvent()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.CompletedTask);
                     var fakePackageService = new Mock<IPackageService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
                     var fakeTelemetryService = new Mock<ITelemetryService>();
@@ -2647,7 +2647,7 @@ public async Task WillApplyEdits(EditPackageVersionRequest edit)
                     var packageService = new Mock<IPackageService>();
 
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "thePackageId" }, Version = "1.0.0" };
-                    packageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    packageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
                         .Returns(Task.FromResult(fakePackage));
 
                     var fakeEditPackageService = new Mock<EditPackageService>();
@@ -2711,7 +2711,7 @@ public async Task WillApplyReadMeForWrittenReadMeData(EditPackageVersionRequest
 
                 var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "thePackageId" }, Version = "1.0.0" };
                 packageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(),
-                    It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>()))
+                    It.IsAny<User>(), It.IsAny<bool>()))
                     .Returns(Task.FromResult(fakePackage));
 
                 var fakeEditPackageService = new Mock<EditPackageService>();
diff --git a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
index 0e10b1d710..3adf8d1789 100644
--- a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
+++ b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
@@ -149,6 +149,9 @@
       <HintPath>..\..\packages\Microsoft.Owin.Security.Cookies.3.0.1\lib\net45\Microsoft.Owin.Security.Cookies.dll</HintPath>
       <Private>True</Private>
     </Reference>
+    <Reference Include="Microsoft.ServiceBus, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\WindowsAzure.ServiceBus.4.1.3\lib\net45\Microsoft.ServiceBus.dll</HintPath>
+    </Reference>
     <Reference Include="Microsoft.Threading.Tasks, Version=1.0.12.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
       <SpecificVersion>False</SpecificVersion>
       <HintPath>..\..\packages\Microsoft.Bcl.Async.1.0.168\lib\net40\Microsoft.Threading.Tasks.dll</HintPath>
@@ -219,10 +222,19 @@
     <Reference Include="NuGet.Protocol, Version=4.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
       <HintPath>..\..\packages\NuGet.Protocol.4.3.0-preview1-2524\lib\net45\NuGet.Protocol.dll</HintPath>
     </Reference>
+    <Reference Include="NuGet.Services.Contracts, Version=2.3.0.0, Culture=neutral, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\NuGet.Services.Contracts.2.3.0-dev-14813\lib\net45\NuGet.Services.Contracts.dll</HintPath>
+    </Reference>
     <Reference Include="NuGet.Services.KeyVault, Version=1.0.0.0, Culture=neutral, processorArchitecture=MSIL">
       <HintPath>..\..\packages\NuGet.Services.KeyVault.1.0.0.0\lib\net45\NuGet.Services.KeyVault.dll</HintPath>
       <Private>True</Private>
     </Reference>
+    <Reference Include="NuGet.Services.ServiceBus, Version=2.3.0.0, Culture=neutral, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\NuGet.Services.ServiceBus.2.3.0-dev-14813\lib\net45\NuGet.Services.ServiceBus.dll</HintPath>
+    </Reference>
+    <Reference Include="NuGet.Services.Validation, Version=2.3.0.0, Culture=neutral, processorArchitecture=MSIL">
+      <HintPath>..\..\packages\NuGet.Services.Validation.2.3.0-dev-14813\lib\net45\NuGet.Services.Validation.dll</HintPath>
+    </Reference>
     <Reference Include="NuGet.Versioning, Version=4.3.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=MSIL">
       <HintPath>..\..\packages\NuGet.Versioning.4.3.0-preview1-2524\lib\net45\NuGet.Versioning.dll</HintPath>
     </Reference>
@@ -430,6 +442,8 @@
     <Compile Include="Security\TestSecurityPolicyService.cs" />
     <Compile Include="Security\TestUserSecurityPolicyData.cs" />
     <Compile Include="Services\AllowLocalHttpRedirectPolicyFacts.cs" />
+    <Compile Include="Services\AsynchronousPackageValidationInitiatorFacts.cs" />
+    <Compile Include="Services\ImmediatePackageValidatorFacts.cs" />
     <Compile Include="Services\NoLessSecureDestinationRedirectPolicyFacts.cs" />
     <Compile Include="Services\PagerDutyClientFacts.cs" />
     <Compile Include="Services\PackageUploadServiceFacts.cs" />
@@ -437,6 +451,7 @@
     <Compile Include="Services\ReservedNamespaceServiceFacts.cs" />
     <Compile Include="Services\ScopeEvaluatorFacts.cs" />
     <Compile Include="Services\SearchAdaptorFacts.cs" />
+    <Compile Include="Services\ValidationServiceFacts.cs" />
     <Compile Include="Telemetry\ClientInformationTelemetryEnricherTests.cs" />
     <Compile Include="TestUtils\Infrastructure\TestableV1Feed.cs" />
     <Compile Include="TestUtils\Infrastructure\TestableV2Feed.cs" />
diff --git a/tests/NuGetGallery.Facts/Services/AsynchronousPackageValidationInitiatorFacts.cs b/tests/NuGetGallery.Facts/Services/AsynchronousPackageValidationInitiatorFacts.cs
new file mode 100644
index 0000000000..675167d753
--- /dev/null
+++ b/tests/NuGetGallery.Facts/Services/AsynchronousPackageValidationInitiatorFacts.cs
@@ -0,0 +1,127 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Moq;
+using NuGet.Services.Validation;
+using NuGetGallery.Configuration;
+using NuGetGallery.Diagnostics;
+using Xunit;
+
+namespace NuGetGallery
+{
+    public class AsynchronousPackageValidationInitiatorFacts
+    {
+        public class TheStartValidationAsyncMethod : FactsBase
+        {
+            [Fact]
+            public async Task UsesADifferentValidationTrackingIdEachTime()
+            {
+                // Arrange
+                var package = GetPackage();
+
+                // Act
+                await _target.StartValidationAsync(package);
+                await _target.StartValidationAsync(package);
+
+                // Assert
+                Assert.Equal(2, _data.Count);
+                Assert.NotEqual(_data[0].ValidationTrackingId, _data[1].ValidationTrackingId);
+            }
+
+            [Fact]
+            public async Task UsesProvidedPackageIdAndVersion()
+            {
+                // Arrange
+                var package = GetPackage();
+
+                // Act
+                await _target.StartValidationAsync(package);
+
+                // Assert
+                _enqueuer.Verify(
+                    x => x.StartValidationAsync(It.IsAny<PackageValidationMessageData>()),
+                    Times.Once);
+                Assert.Equal(1, _data.Count);
+                Assert.NotNull(_data[0]);
+                Assert.Equal(package.PackageRegistration.Id, _data[0].PackageId);
+                Assert.Equal(package.Version, _data[0].PackageVersion);
+            }
+
+            [Fact]
+            public async Task FailsWhenTheGalleryIsInReadOnlyMode()
+            {
+                // Arrange
+                var package = GetPackage();
+                _appConfiguration
+                    .Setup(x => x.ReadOnlyMode)
+                    .Returns(true);
+
+                // Act & Assert
+                var exception = await Assert.ThrowsAsync<ReadOnlyModeException>(
+                    () => _target.StartValidationAsync(package));
+                Assert.Equal(Strings.CannotEnqueueDueToReadOnly, exception.Message);
+                _enqueuer.Verify(
+                    x => x.StartValidationAsync(It.IsAny<PackageValidationMessageData>()),
+                    Times.Never);
+            }
+
+            [Fact]
+            public async Task ReturnsCorrectPackageStatus()
+            {
+                // Arrange
+                var package = GetPackage();
+
+                // Act
+                var actual = await _target.StartValidationAsync(package);
+
+                // Assert
+                Assert.Equal(PackageStatus.Available, actual);
+            }
+
+            private Package GetPackage()
+            {
+                return new Package
+                {
+                    PackageRegistration = new PackageRegistration
+                    {
+                        Id = "NuGet.Versioning"
+                    },
+                    Version = "4.3.0",
+                    PackageStatusKey = (PackageStatus)(-1),
+                };
+            }
+        }
+
+        public abstract class FactsBase
+        {
+            protected readonly Mock<IPackageValidationEnqueuer> _enqueuer;
+            protected readonly Mock<IAppConfiguration> _appConfiguration;
+            protected readonly Mock<IDiagnosticsService> _diagnosticsService;
+            protected readonly IList<PackageValidationMessageData> _data = new List<PackageValidationMessageData>();
+            protected readonly AsynchronousPackageValidationInitiator _target;
+
+            public FactsBase()
+            {
+                _enqueuer = new Mock<IPackageValidationEnqueuer>();
+                _enqueuer
+                    .Setup(x => x.StartValidationAsync(It.IsAny<PackageValidationMessageData>()))
+                    .Returns(Task.CompletedTask)
+                    .Callback<PackageValidationMessageData>(x => _data.Add(x));
+
+                _appConfiguration = new Mock<IAppConfiguration>();
+                _appConfiguration
+                    .Setup(x => x.ReadOnlyMode)
+                    .Returns(false);
+
+                _diagnosticsService = new Mock<IDiagnosticsService>();
+
+                _target = new AsynchronousPackageValidationInitiator(
+                    _enqueuer.Object,
+                    _appConfiguration.Object,
+                    _diagnosticsService.Object);
+            }
+        }
+    }
+}
diff --git a/tests/NuGetGallery.Facts/Services/ImmediatePackageValidatorFacts.cs b/tests/NuGetGallery.Facts/Services/ImmediatePackageValidatorFacts.cs
new file mode 100644
index 0000000000..58080a674b
--- /dev/null
+++ b/tests/NuGetGallery.Facts/Services/ImmediatePackageValidatorFacts.cs
@@ -0,0 +1,28 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Threading.Tasks;
+using Xunit;
+
+namespace NuGetGallery
+{
+    public class ImmediatePackageValidatorFacts
+    {
+        public class TheStartValidationAsyncMethod
+        {
+            [Fact]
+            public async Task ReturnsAvailable()
+            {
+                // Arrange
+                var package = new Package();
+                var target = new ImmediatePackageValidator();
+
+                // Act
+                var actual = await target.StartValidationAsync(package);
+
+                // Assert
+                Assert.Equal(PackageStatus.Available, actual);
+            }
+        }
+    }
+}
diff --git a/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
index 26f6d2badf..29a47750c6 100644
--- a/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageServiceFacts.cs
@@ -23,7 +23,6 @@ private static IPackageService CreateService(
             Mock<IEntityRepository<PackageRegistration>> packageRegistrationRepository = null,
             Mock<IEntityRepository<Package>> packageRepository = null,
             Mock<IPackageOwnerRequestService> packageOwnerRequestService = null,
-            Mock<IIndexingService> indexingService = null,
             IPackageNamingConflictValidator packageNamingConflictValidator = null,
             IAuditingService auditingService = null,
             Action<Mock<PackageService>> setup = null)
@@ -31,7 +30,6 @@ private static IPackageService CreateService(
             packageRegistrationRepository = packageRegistrationRepository ?? new Mock<IEntityRepository<PackageRegistration>>();
             packageRepository = packageRepository ?? new Mock<IEntityRepository<Package>>();
             packageOwnerRequestService = packageOwnerRequestService ?? new Mock<IPackageOwnerRequestService>();
-            indexingService = indexingService ?? new Mock<IIndexingService>();
             auditingService = auditingService ?? new TestAuditingService();
 
             if (packageNamingConflictValidator == null)
@@ -45,7 +43,6 @@ private static IPackageService CreateService(
                 packageRegistrationRepository.Object,
                 packageRepository.Object,
                 packageOwnerRequestService.Object,
-                indexingService.Object,
                 packageNamingConflictValidator,
                 auditingService);
 
@@ -134,7 +131,6 @@ public void WillCreateANewPackageRegistrationUsingTheNugetPackIdWhenOneDoesNotAl
                 service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false);
 
                 packageRegistrationRepository.Verify(x => x.InsertOnCommit(It.Is<PackageRegistration>(pr => pr.Id == "theId")));
-                packageRegistrationRepository.Verify(x => x.CommitChangesAsync());
             }
 
             [Fact]
@@ -174,7 +170,7 @@ public async Task WillThrowWhenCreateANewPackageRegistrationWithAnIdThatMatchesA
                 var nugetPackage = PackageServiceUtility.CreateNuGetPackage(id: idThatMatchesExistingTitle);
 
                 // Assert
-                var ex = await Assert.ThrowsAsync<InvalidPackageException>(async () => await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false, commitChanges: true));
+                var ex = await Assert.ThrowsAsync<InvalidPackageException>(async () => await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false));
 
                 Assert.Equal(String.Format(Strings.NewRegistrationIdMatchesExistingPackageTitle, idThatMatchesExistingTitle), ex.Message);
             }
@@ -252,8 +248,6 @@ public async Task WillReadPrereleaseFlagFromNuGetPackage()
                 var packageRegistrationRepository = new Mock<IEntityRepository<PackageRegistration>>(MockBehavior.Strict);
                 packageRegistrationRepository.Setup(r => r.GetAll()).Returns(Enumerable.Empty<PackageRegistration>().AsQueryable());
                 packageRegistrationRepository.Setup(r => r.InsertOnCommit(It.IsAny<PackageRegistration>())).Returns(1).Verifiable();
-                packageRegistrationRepository.Setup(r => r.CommitChangesAsync())
-                    .Returns(Task.CompletedTask).Verifiable();
                 var service = CreateService(packageRegistrationRepository: packageRegistrationRepository, setup:
                         mockPackageService => { mockPackageService.Setup(x => x.FindPackageRegistrationById(It.IsAny<string>())).Returns((PackageRegistration)null); });
                 var nugetPackage = PackageServiceUtility.CreateNuGetPackage(version: "2.14.0-a");
@@ -268,86 +262,23 @@ public async Task WillReadPrereleaseFlagFromNuGetPackage()
             }
 
             [Fact]
-            public async Task DoNotCommitChangesIfCommitChangesIsFalse()
-            {
-                // Arrange
-                var packageRegistrationRepository = new Mock<IEntityRepository<PackageRegistration>>(MockBehavior.Strict);
-                packageRegistrationRepository.Setup(r => r.GetAll()).Returns(Enumerable.Empty<PackageRegistration>().AsQueryable());
-                packageRegistrationRepository.Setup(r => r.InsertOnCommit(It.IsAny<PackageRegistration>())).Returns(1).Verifiable();
-                var service = CreateService(packageRegistrationRepository: packageRegistrationRepository, setup:
-                        mockPackageService => { mockPackageService.Setup(x => x.FindPackageRegistrationById(It.IsAny<string>())).Returns((PackageRegistration)null); });
-                var nugetPackage = PackageServiceUtility.CreateNuGetPackage(version: "2.14.0-a");
-                var currentUser = new User();
-
-                // Act
-                var package = await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false, commitChanges: false);
-
-                // Assert
-                packageRegistrationRepository.Verify();
-            }
-
-            [Fact]
-            public async Task DoNotUpdateIndexIfCommitChangesIsFalse()
-            {
-                // Arrange
-                var packageRegistrationRepository = new Mock<IEntityRepository<PackageRegistration>>(MockBehavior.Strict);
-                packageRegistrationRepository.Setup(r => r.GetAll()).Returns(Enumerable.Empty<PackageRegistration>().AsQueryable());
-                packageRegistrationRepository.Setup(r => r.InsertOnCommit(It.IsAny<PackageRegistration>())).Returns(1).Verifiable();
-                var indexingService = new Mock<IIndexingService>(MockBehavior.Strict);
-                var service = CreateService(indexingService: indexingService, packageRegistrationRepository: packageRegistrationRepository, setup:
-                        mockPackageService => { mockPackageService.Setup(x => x.FindPackageRegistrationById(It.IsAny<string>())).Returns((PackageRegistration)null); });
-
-                var nugetPackage = PackageServiceUtility.CreateNuGetPackage(version: "2.14.0-a");
-                var currentUser = new User();
-
-                // Act
-                var package = await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false, commitChanges: false);
-            }
-
-            [Fact]
-            public async Task UpdateIndexIfCommitChangesIsTrue()
+            public async Task DoNotCommitChanges()
             {
                 // Arrange
                 var packageRegistrationRepository = new Mock<IEntityRepository<PackageRegistration>>(MockBehavior.Strict);
                 packageRegistrationRepository.Setup(r => r.GetAll()).Returns(Enumerable.Empty<PackageRegistration>().AsQueryable());
                 packageRegistrationRepository.Setup(r => r.InsertOnCommit(It.IsAny<PackageRegistration>())).Returns(1).Verifiable();
-                packageRegistrationRepository.Setup(r => r.CommitChangesAsync())
-                    .Returns(Task.CompletedTask).Verifiable();
-                var indexingService = new Mock<IIndexingService>(MockBehavior.Strict);
-                indexingService.Setup(s => s.UpdateIndex()).Verifiable();
-                var service = CreateService(indexingService: indexingService, packageRegistrationRepository: packageRegistrationRepository, setup:
-                        mockPackageService => { mockPackageService.Setup(x => x.FindPackageRegistrationById(It.IsAny<string>())).Returns((PackageRegistration)null); });
-                var nugetPackage = PackageServiceUtility.CreateNuGetPackage(version: "2.14.0-a");
-                var currentUser = new User();
-
-                // Act
-                var package = await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false, commitChanges: true);
-
-                // Assert
-                indexingService.Verify();
-            }
-
-            [Fact]
-            public async Task CommitChangesIfCommitChangesIsTrue()
-            {
-                // Arrange
-                var packageRegistrationRepository = new Mock<IEntityRepository<PackageRegistration>>(MockBehavior.Strict);
-                packageRegistrationRepository.Setup(r => r.GetAll())
-                    .Returns(Enumerable.Empty<PackageRegistration>().AsQueryable());
-                packageRegistrationRepository.Setup(r => r.InsertOnCommit(It.IsAny<PackageRegistration>()))
-                    .Returns(1).Verifiable();
-                packageRegistrationRepository.Setup(r => r.CommitChangesAsync())
-                    .Returns(Task.CompletedTask).Verifiable();
                 var service = CreateService(packageRegistrationRepository: packageRegistrationRepository, setup:
                         mockPackageService => { mockPackageService.Setup(x => x.FindPackageRegistrationById(It.IsAny<string>())).Returns((PackageRegistration)null); });
                 var nugetPackage = PackageServiceUtility.CreateNuGetPackage(version: "2.14.0-a");
                 var currentUser = new User();
 
                 // Act
-                var package = await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false, commitChanges: true);
+                var package = await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false);
 
                 // Assert
                 packageRegistrationRepository.Verify();
+                packageRegistrationRepository.Verify(x => x.CommitChangesAsync(), Times.Never);
             }
 
             [Fact]
@@ -444,7 +375,6 @@ private async Task WillSaveTheCreatedPackageWhenANewPackageRegistrationIsCreated
                 var package = await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false);
 
                 packageRegistrationRepository.Verify(x => x.InsertOnCommit(It.Is<PackageRegistration>(pr => pr.Packages.ElementAt(0) == package)));
-                packageRegistrationRepository.Verify(x => x.CommitChangesAsync());
             }
 
             [Fact]
@@ -464,7 +394,6 @@ private async Task WillSaveTheCreatedPackageWhenThePackageRegistrationAlreadyExi
                 var package = await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false);
 
                 Assert.Same(packageRegistration.Packages.ElementAt(0), package);
-                packageRegistrationRepository.Verify(x => x.CommitChangesAsync());
             }
 
             [Fact]
@@ -481,7 +410,7 @@ private async Task WillThrowIfThePackageRegistrationAlreadyExistsAndTheCurrentUs
                         mockPackageService => { mockPackageService.Setup(x => x.FindPackageRegistrationById(It.IsAny<string>())).Returns(packageRegistration); });
                 var nugetPackage = PackageServiceUtility.CreateNuGetPackage();
 
-                var ex = await Assert.ThrowsAsync<InvalidPackageException>(async () => await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false, commitChanges: true));
+                var ex = await Assert.ThrowsAsync<InvalidPackageException>(async () => await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false));
 
                 Assert.Equal(String.Format(Strings.PackageIdNotAvailable, "theId"), ex.Message);
             }
@@ -509,7 +438,7 @@ private async Task WillThrowIfThePackageTitleMatchesAnExistingPackageRegistratio
                 var nugetPackage = PackageServiceUtility.CreateNuGetPackage(title: newPackageTitle);
 
                 // Assert
-                var ex = await Assert.ThrowsAsync<InvalidPackageException>(async () => await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false, commitChanges: true));
+                var ex = await Assert.ThrowsAsync<InvalidPackageException>(async () => await service.CreatePackageAsync(nugetPackage.Object, new PackageStreamMetadata(), currentUser, isVerified: false));
 
                 Assert.Equal(String.Format(Strings.TitleMatchesExistingRegistration, newPackageTitle), ex.Message);
             }
diff --git a/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs
index 9a8d67965a..01b4778822 100644
--- a/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs
@@ -3,17 +3,13 @@
 
 using System;
 using System.Collections.Generic;
-using System.Data.Entity;
-using System.IO;
-using System.IO.Compression;
 using System.Linq;
 using System.Threading.Tasks;
 using Moq;
 using NuGet.Packaging;
-using NuGetGallery.Framework;
 using NuGetGallery.Packaging;
-using Xunit;
 using NuGetGallery.TestUtils;
+using Xunit;
 
 namespace NuGetGallery
 {
@@ -23,47 +19,77 @@ public class PackageUploadServiceFacts
 
         private static PackageUploadService CreateService(
             Mock<IPackageService> packageService = null,
-            Mock<IReservedNamespaceService> reservedNamespaceService = null)
+            Mock<IReservedNamespaceService> reservedNamespaceService = null,
+            Mock<IValidationService> validationService = null)
         {
-            {
             if (packageService == null)
+            {
                 packageService = new Mock<IPackageService>();
-                packageService.Setup(x => x.FindPackageRegistrationById(It.IsAny<string>())).Returns((PackageRegistration)null);
-                packageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), It.IsAny<bool>())).
-                    Returns((PackageArchiveReader packageArchiveReader, PackageStreamMetadata packageStreamMetadata, User user, bool isVerified, bool commitChanges) =>
-                    {
-                        var packageMetadata = PackageMetadata.FromNuspecReader(packageArchiveReader.GetNuspecReader());
-
-                        var newPackage = new Package();
-                        newPackage.PackageRegistration = new PackageRegistration { Id = packageMetadata.Id, IsVerified = isVerified };
-                        newPackage.Version = packageMetadata.Version.ToString();
-                        newPackage.SemVerLevelKey = SemVerLevelKey.ForPackage(packageMetadata.Version, packageMetadata.GetDependencyGroups().AsPackageDependencyEnumerable());
-
-                        return Task.FromResult(newPackage);
-                    });
             }
-            
+
+            packageService.Setup(x => x.FindPackageRegistrationById(It.IsAny<string>())).Returns((PackageRegistration)null);
+            packageService.Setup(x => x
+                .CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                .Returns((PackageArchiveReader packageArchiveReader, PackageStreamMetadata packageStreamMetadata, User user, bool isVerified) =>
+                {
+                    var packageMetadata = PackageMetadata.FromNuspecReader(packageArchiveReader.GetNuspecReader());
+
+                    var newPackage = new Package();
+                    newPackage.PackageRegistration = new PackageRegistration { Id = packageMetadata.Id, IsVerified = isVerified };
+                    newPackage.Version = packageMetadata.Version.ToString();
+                    newPackage.SemVerLevelKey = SemVerLevelKey.ForPackage(packageMetadata.Version, packageMetadata.GetDependencyGroups().AsPackageDependencyEnumerable());
+
+                    return Task.FromResult(newPackage);
+                });
+
             if (reservedNamespaceService == null)
             {
                 reservedNamespaceService = new Mock<IReservedNamespaceService>();
+
                 IReadOnlyCollection<ReservedNamespace> userOwnedMatchingNamespaces = new List<ReservedNamespace>();
-                reservedNamespaceService.Setup(s => s.IsPushAllowed(It.IsAny<string>(), It.IsAny<User>(), out userOwnedMatchingNamespaces))
+                reservedNamespaceService
+                    .Setup(s => s.IsPushAllowed(It.IsAny<string>(), It.IsAny<User>(), out userOwnedMatchingNamespaces))
                     .Returns(true);
             }
 
+            if (validationService == null)
+            {
+                validationService = new Mock<IValidationService>();
+            }
+
             var packageUploadService = new Mock<PackageUploadService>(
                 packageService.Object,
-                reservedNamespaceService.Object);
+                reservedNamespaceService.Object,
+                validationService.Object);
 
             return packageUploadService.Object;
         }
 
         public class TheGeneratePackageAsyncMethod
         {
-            [Theory]
-            [InlineData(true)]
-            [InlineData(false)]
-            public async Task WillCallCreatePackageAsyncCorrectly(bool commitChangesParameter)
+            [Fact]
+            public async Task WillStartAsynchronousValidation()
+            {
+                var validationService = new Mock<IValidationService>();
+
+                var id = "Microsoft.Aspnet.Mvc";
+                var packageUploadService = CreateService(validationService: validationService);
+                var nugetPackage = PackageServiceUtility.CreateNuGetPackage(id: id);
+                var currentUser = new User();
+
+                var package = await packageUploadService.GeneratePackageAsync(
+                    id,
+                    nugetPackage.Object,
+                    new PackageStreamMetadata(),
+                    currentUser);
+
+                validationService.Verify(
+                    x => x.StartValidationAsync(package),
+                    Times.Once);
+            }
+
+            [Fact]
+            public async Task WillCallCreatePackageAsyncCorrectly()
             {
                 var packageService = new Mock<IPackageService>();
                 packageService.Setup(x => x.FindPackageRegistrationById(It.IsAny<string>())).Returns((PackageRegistration)null);
@@ -73,9 +99,9 @@ public async Task WillCallCreatePackageAsyncCorrectly(bool commitChangesParamete
                 var nugetPackage = PackageServiceUtility.CreateNuGetPackage(id: id);
                 var currentUser = new User();
 
-                var package = await packageUploadService.GeneratePackageAsync(id, nugetPackage.Object, new PackageStreamMetadata(), currentUser, commitChanges: commitChangesParameter);
+                var package = await packageUploadService.GeneratePackageAsync(id, nugetPackage.Object, new PackageStreamMetadata(), currentUser);
 
-                packageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>(), commitChangesParameter), Times.Once);
+                packageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()), Times.Once);
                 Assert.False(package.PackageRegistration.IsVerified);
             }
 
@@ -105,7 +131,7 @@ public async Task WillMarkPackageRegistrationVerifiedFlagCorrectly(bool shouldMa
                 var packageUploadService = CreateService(reservedNamespaceService: reservedNamespaceService);
                 var nugetPackage = PackageServiceUtility.CreateNuGetPackage(id: id);
 
-                var package = await packageUploadService.GeneratePackageAsync(id, nugetPackage.Object, new PackageStreamMetadata(), firstUser, commitChanges: true);
+                var package = await packageUploadService.GeneratePackageAsync(id, nugetPackage.Object, new PackageStreamMetadata(), firstUser);
 
                 Assert.Equal(shouldMarkIdVerified, package.PackageRegistration.IsVerified);
             }
@@ -133,7 +159,7 @@ public async Task WillMarkPackageRegistrationNotVerifiedIfIdMatchesNonOwnedShare
                 var packageUploadService = CreateService(reservedNamespaceService: reservedNamespaceService);
                 var nugetPackage = PackageServiceUtility.CreateNuGetPackage(id: id);
 
-                var package = await packageUploadService.GeneratePackageAsync(id, nugetPackage.Object, new PackageStreamMetadata(), lastUser, commitChanges: true);
+                var package = await packageUploadService.GeneratePackageAsync(id, nugetPackage.Object, new PackageStreamMetadata(), lastUser);
 
                 Assert.False(package.PackageRegistration.IsVerified);
             }
diff --git a/tests/NuGetGallery.Facts/Services/ReflowPackageServiceFacts.cs b/tests/NuGetGallery.Facts/Services/ReflowPackageServiceFacts.cs
index b6e387e312..c09d0ab90e 100644
--- a/tests/NuGetGallery.Facts/Services/ReflowPackageServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/ReflowPackageServiceFacts.cs
@@ -267,7 +267,6 @@ private static Mock<PackageService> SetupPackageService(Package package)
             var packageRegistrationRepository = new Mock<IEntityRepository<PackageRegistration>>();
             var packageRepository = new Mock<IEntityRepository<Package>>();
             var packageOwnerRequestService = new Mock<IPackageOwnerRequestService>();
-            var indexingService = new Mock<IIndexingService>();
             var packageNamingConflictValidator = new PackageNamingConflictValidator(
                     packageRegistrationRepository.Object,
                     packageRepository.Object);
@@ -277,7 +276,6 @@ private static Mock<PackageService> SetupPackageService(Package package)
                 packageRegistrationRepository.Object,
                 packageRepository.Object,
                 packageOwnerRequestService.Object,
-                indexingService.Object,
                 packageNamingConflictValidator,
                 auditingService);
 
diff --git a/tests/NuGetGallery.Facts/Services/ReservedNamespaceServiceFacts.cs b/tests/NuGetGallery.Facts/Services/ReservedNamespaceServiceFacts.cs
index 4a44b04b0d..585e7dec89 100644
--- a/tests/NuGetGallery.Facts/Services/ReservedNamespaceServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/ReservedNamespaceServiceFacts.cs
@@ -438,40 +438,40 @@ public async Task AddingOwnerToAbsoluteNamespaceMarksOnlyAbsoluteRegistrationsVe
         }
 
 
-        public class TheAddPackageRegistrationToNamespaceAsyncMethod
+        public class TheAddPackageRegistrationToNamespaceMethod
         {
             [Theory]
             [InlineData(null)]
             [InlineData("")]
             [InlineData("  ")]
-            public async Task NullNamespaceThrowsException(string value)
+            public void NullNamespaceThrowsException(string value)
             {
                 var service = new TestableReservedNamespaceService();
 
-                await Assert.ThrowsAsync<ArgumentException>(async () => await service.AddPackageRegistrationToNamespaceAsync(value, new PackageRegistration()));
+                Assert.Throws<ArgumentException>(() => service.AddPackageRegistrationToNamespace(value, new PackageRegistration()));
             }
 
             [Fact]
-            public async Task NullPackageRegistrationThrowsException()
+            public void NullPackageRegistrationThrowsException()
             {
                 var service = new TestableReservedNamespaceService();
 
-                await Assert.ThrowsAsync<ArgumentNullException>(async () => await service.AddPackageRegistrationToNamespaceAsync("Microsoft.", null));
+                Assert.Throws<ArgumentNullException>(() => service.AddPackageRegistrationToNamespace("Microsoft.", null));
             }
 
             [Fact]
-            public async Task NonExistentNamespaceThrowsException()
+            public void NonExistentNamespaceThrowsException()
             {
                 var testNamespaces = ReservedNamespaceServiceTestData.GetTestNamespaces();
                 var testPackageRegistrations = ReservedNamespaceServiceTestData.GetRegistrations();
                 var existingReg = testPackageRegistrations.First();
                 var service = new TestableReservedNamespaceService(reservedNamespaces: testNamespaces, packageRegistrations: testPackageRegistrations);
 
-                await Assert.ThrowsAsync<InvalidOperationException>(async () => await service.AddPackageRegistrationToNamespaceAsync("Non.Existent.Namespace.", existingReg));
+                Assert.Throws<InvalidOperationException>(() => service.AddPackageRegistrationToNamespace("Non.Existent.Namespace.", existingReg));
             }
 
             [Fact]
-            public async Task PackageRegistrationIsAddedWithCommitSuccessfully()
+            public void PackageRegistrationIsAddedWithCommitSuccessfully()
             {
                 var testNamespaces = ReservedNamespaceServiceTestData.GetTestNamespaces();
                 var existingNamespace = testNamespaces.First();
@@ -479,16 +479,13 @@ public async Task PackageRegistrationIsAddedWithCommitSuccessfully()
                 var existingReg = testPackageRegistrations.First();
                 var service = new TestableReservedNamespaceService(reservedNamespaces: testNamespaces, packageRegistrations: testPackageRegistrations);
 
-                await service.AddPackageRegistrationToNamespaceAsync(existingNamespace.Value, existingReg, commitChanges: true);
-
-                service
-                    .MockReservedNamespaceRepository
-                    .Verify(x => x.CommitChangesAsync());
+                service.AddPackageRegistrationToNamespace(existingNamespace.Value, existingReg);
+                
                 Assert.True(existingNamespace.PackageRegistrations.Contains(existingReg));
             }
 
             [Fact]
-            public async Task CommitChangesIsNotExecuted()
+            public void CommitChangesIsNotExecuted()
             {
                 var testNamespaces = ReservedNamespaceServiceTestData.GetTestNamespaces();
                 var existingNamespace = testNamespaces.First();
@@ -496,12 +493,11 @@ public async Task CommitChangesIsNotExecuted()
                 var existingReg = testPackageRegistrations.First();
                 var service = new TestableReservedNamespaceService(reservedNamespaces: testNamespaces, packageRegistrations: testPackageRegistrations);
 
-                await service.AddPackageRegistrationToNamespaceAsync(existingNamespace.Value, existingReg, commitChanges: false);
+                service.AddPackageRegistrationToNamespace(existingNamespace.Value, existingReg);
 
                 service
                     .MockReservedNamespaceRepository
                     .Verify(x => x.CommitChangesAsync(), Times.Never);
-                Assert.True(existingNamespace.PackageRegistrations.Contains(existingReg));
             }
         }
 
diff --git a/tests/NuGetGallery.Facts/Services/ValidationServiceFacts.cs b/tests/NuGetGallery.Facts/Services/ValidationServiceFacts.cs
new file mode 100644
index 0000000000..a9656459eb
--- /dev/null
+++ b/tests/NuGetGallery.Facts/Services/ValidationServiceFacts.cs
@@ -0,0 +1,68 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Threading.Tasks;
+using Moq;
+using Xunit;
+
+namespace NuGetGallery
+{
+    public class ValidationServiceFacts
+    {
+        public class TheStartValidationMethod : FactsBase
+        {
+            [Fact]
+            public async Task InitiatesTheValidation()
+            {
+                // Arrange & Act
+                await _target.StartValidationAsync(_package);
+
+                // Assert
+                _initiator.Verify(x => x.StartValidationAsync(_package), Times.Once);
+            }
+
+            [Fact]
+            public async Task UpdatesThePackageStatus()
+            {
+                // Arrange
+                var packageStatus = PackageStatus.Validating;
+                _package.PackageStatusKey = PackageStatus.Available;
+                _initiator
+                    .Setup(x => x.StartValidationAsync(It.IsAny<Package>()))
+                    .ReturnsAsync(packageStatus);
+
+                // Act
+                await _target.StartValidationAsync(_package);
+
+                // Assert
+                _packageService.Verify(
+                    x => x.UpdatePackageStatusAsync(_package, packageStatus, false),
+                    Times.Once);
+
+                /// The implementation should not change the package status on its own. It should depend on 
+                /// <see cref="IPackageService"/> to do this.
+                Assert.Equal(PackageStatus.Available, _package.PackageStatusKey);
+            }
+        }
+
+        public class FactsBase
+        {
+            protected readonly Mock<IPackageService> _packageService;
+            protected readonly Mock<IPackageValidationInitiator> _initiator;
+            protected readonly Package _package;
+            protected readonly ValidationService _target;
+
+            public FactsBase()
+            {
+                _packageService = new Mock<IPackageService>();
+                _initiator = new Mock<IPackageValidationInitiator>();
+
+                _package = new Package();
+
+                _target = new ValidationService(
+                    _packageService.Object,
+                    _initiator.Object);
+            }
+        }
+    }
+}
diff --git a/tests/NuGetGallery.Facts/TestUtils/TestServiceUtility.cs b/tests/NuGetGallery.Facts/TestUtils/TestServiceUtility.cs
index 6545e22234..015a755d24 100644
--- a/tests/NuGetGallery.Facts/TestUtils/TestServiceUtility.cs
+++ b/tests/NuGetGallery.Facts/TestUtils/TestServiceUtility.cs
@@ -269,7 +269,6 @@ private Mock<PackageService> SetupPackageService()
 
             var packageRepository = new Mock<IEntityRepository<Package>>();
             var packageOwnerRequestService = new Mock<IPackageOwnerRequestService>();
-            var indexingService = new Mock<IIndexingService>();
             var packageNamingConflictValidator = new PackageNamingConflictValidator(
                     packageRegistrationRepository.Object,
                     packageRepository.Object);
@@ -279,7 +278,6 @@ private Mock<PackageService> SetupPackageService()
                 packageRegistrationRepository.Object,
                 packageRepository.Object,
                 packageOwnerRequestService.Object,
-                indexingService.Object,
                 packageNamingConflictValidator,
                 auditingService);
 
diff --git a/tests/NuGetGallery.Facts/packages.config b/tests/NuGetGallery.Facts/packages.config
index 41ea2be0f6..6c95effb8c 100644
--- a/tests/NuGetGallery.Facts/packages.config
+++ b/tests/NuGetGallery.Facts/packages.config
@@ -45,7 +45,10 @@
   <package id="NuGet.Packaging" version="4.3.0-preview1-2524" targetFramework="net46" />
   <package id="NuGet.Packaging.Core" version="4.3.0-preview1-2524" targetFramework="net46" />
   <package id="NuGet.Protocol" version="4.3.0-preview1-2524" targetFramework="net46" />
+  <package id="NuGet.Services.Contracts" version="2.3.0-dev-14813" targetFramework="net46" />
   <package id="NuGet.Services.KeyVault" version="1.0.0.0" targetFramework="net46" />
+  <package id="NuGet.Services.ServiceBus" version="2.3.0-dev-14813" targetFramework="net46" />
+  <package id="NuGet.Services.Validation" version="2.3.0-dev-14813" targetFramework="net46" />
   <package id="NuGet.Versioning" version="4.3.0-preview1-2524" targetFramework="net46" />
   <package id="Owin" version="1.0" targetFramework="net46" />
   <package id="PoliteCaptcha" version="0.4.0.1" targetFramework="net46" />
@@ -82,6 +85,7 @@
   <package id="WebActivatorEx" version="2.0.6" targetFramework="net46" />
   <package id="WebBackgrounder" version="0.2.0" targetFramework="net46" />
   <package id="WebBackgrounder.EntityFramework" version="0.1" targetFramework="net46" />
+  <package id="WindowsAzure.ServiceBus" version="4.1.3" targetFramework="net46" />
   <package id="WindowsAzure.Storage" version="7.0.0" targetFramework="net46" />
   <package id="xunit" version="2.0.0" targetFramework="net46" />
   <package id="xunit.abstractions" version="2.0.0" targetFramework="net46" />

From 2deb2aa9fd6c6da9e2f52ef226d27444cfec6c9a Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Tue, 26 Sep 2017 15:39:32 -0700
Subject: [PATCH 14/25] Filter out unavailable packages in curated feed
 controller (#4755)

Fix https://github.com/NuGet/NuGetGallery/issues/4750
---
 .../ODataV2CuratedFeedController.cs           |  9 +++-
 .../ODataFeedControllerFactsBase.cs           | 32 +++++++++++++-
 .../ODataV2CuratedFeedControllerFacts.cs      | 43 ++++++++++++++++---
 .../Controllers/ODataV2FeedControllerFacts.cs | 14 +++---
 4 files changed, 80 insertions(+), 18 deletions(-)

diff --git a/src/NuGetGallery/Controllers/ODataV2CuratedFeedController.cs b/src/NuGetGallery/Controllers/ODataV2CuratedFeedController.cs
index c73adef58a..ee8a58ffeb 100644
--- a/src/NuGetGallery/Controllers/ODataV2CuratedFeedController.cs
+++ b/src/NuGetGallery/Controllers/ODataV2CuratedFeedController.cs
@@ -56,7 +56,9 @@ public IHttpActionResult Get(
 
             var semVerLevelKey = SemVerLevelKey.ForSemVerLevel(semVerLevel);
 
-            var queryable = _curatedFeedService.GetPackages(curatedFeedName)
+            var queryable = _curatedFeedService
+                .GetPackages(curatedFeedName)
+                .Where(p => p.PackageStatusKey == PackageStatus.Available)
                 .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel))
                 .ToV2FeedPackageQuery(
                     _configurationService.GetSiteRoot(UseHttps()),
@@ -124,7 +126,9 @@ private async Task<IHttpActionResult> GetCore(
                 return NotFound();
             }
 
-            var packages = _curatedFeedService.GetPackages(curatedFeedName)
+            var packages = _curatedFeedService
+                .GetPackages(curatedFeedName)
+                .Where(p => p.PackageStatusKey == PackageStatus.Available)
                 .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel))
                 .Where(p => p.PackageRegistration.Id.Equals(id, StringComparison.OrdinalIgnoreCase));
 
@@ -239,6 +243,7 @@ public async Task<IHttpActionResult> Search(
             // Perform actual search
             var curatedFeed = _curatedFeedService.GetFeedByName(curatedFeedName, includePackages: false);
             var packages = _curatedFeedService.GetPackages(curatedFeedName)
+                .Where(p => p.PackageStatusKey == PackageStatus.Available)
                 .Where(SemVerLevelKey.IsPackageCompliantWithSemVerLevelPredicate(semVerLevel))
                 .OrderBy(p => p.PackageRegistration.Id).ThenBy(p => p.Version);
 
diff --git a/tests/NuGetGallery.Facts/Controllers/ODataFeedControllerFactsBase.cs b/tests/NuGetGallery.Facts/Controllers/ODataFeedControllerFactsBase.cs
index 35ea5f7519..2cd0183b70 100644
--- a/tests/NuGetGallery.Facts/Controllers/ODataFeedControllerFactsBase.cs
+++ b/tests/NuGetGallery.Facts/Controllers/ODataFeedControllerFactsBase.cs
@@ -27,6 +27,8 @@ public abstract class ODataFeedControllerFactsBase<TController>
         private const string _siteRoot = "https://nuget.localtest.me";
         protected const string TestPackageId = "Some.Awesome.Package";
 
+        protected readonly IReadOnlyCollection<Package> AvailablePackages;
+        protected readonly IReadOnlyCollection<Package> UnavailablePackages;
         protected readonly IReadOnlyCollection<Package> NonSemVer2Packages;
         protected readonly IReadOnlyCollection<Package> SemVer2Packages;
         protected readonly IEntityRepository<Package> PackagesRepository;
@@ -36,8 +38,10 @@ protected ODataFeedControllerFactsBase()
         {
             // Arrange
             AllPackages = CreatePackagesQueryable();
-            NonSemVer2Packages = AllPackages.Where(p => p.SemVerLevelKey == SemVerLevelKey.Unknown).ToList();
-            SemVer2Packages = AllPackages.Where(p => p.SemVerLevelKey == SemVerLevelKey.SemVer2).ToList();
+            AvailablePackages = AllPackages.Where(p => p.PackageStatusKey == PackageStatus.Available).ToList();
+            UnavailablePackages = AllPackages.Where(p => p.PackageStatusKey != PackageStatus.Available).ToList();
+            NonSemVer2Packages = AvailablePackages.Where(p => p.SemVerLevelKey == SemVerLevelKey.Unknown).ToList();
+            SemVer2Packages = AvailablePackages.Where(p => p.SemVerLevelKey == SemVerLevelKey.SemVer2).ToList();
 
             var packagesRepositoryMock = new Mock<IEntityRepository<Package>>(MockBehavior.Strict);
             packagesRepositoryMock.Setup(m => m.GetAll()).Returns(AllPackages).Verifiable();
@@ -118,6 +122,30 @@ private static IQueryable<Package> CreatePackagesQueryable()
 
             var list = new List<Package>
             {
+                new Package
+                {
+                    PackageRegistration = packageRegistration,
+                    Version = "0.9.0.0",
+                    NormalizedVersion = "0.9.0",
+                    SemVerLevelKey = SemVerLevelKey.Unknown,
+                    PackageStatusKey = PackageStatus.Deleted,
+                },
+                new Package
+                {
+                    PackageRegistration = packageRegistration,
+                    Version = "0.8.0.0",
+                    NormalizedVersion = "0.8.0",
+                    SemVerLevelKey = SemVerLevelKey.Unknown,
+                    PackageStatusKey = PackageStatus.Validating,
+                },
+                new Package
+                {
+                    PackageRegistration = packageRegistration,
+                    Version = "0.7.0.0",
+                    NormalizedVersion = "0.7.0",
+                    SemVerLevelKey = SemVerLevelKey.Unknown,
+                    PackageStatusKey = PackageStatus.FailedValidation,
+                },
                 new Package
                 {
                     PackageRegistration = packageRegistration,
diff --git a/tests/NuGetGallery.Facts/Controllers/ODataV2CuratedFeedControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/ODataV2CuratedFeedControllerFacts.cs
index 2a7efa2565..b593f70ddc 100644
--- a/tests/NuGetGallery.Facts/Controllers/ODataV2CuratedFeedControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/ODataV2CuratedFeedControllerFacts.cs
@@ -30,6 +30,22 @@ public async Task Get_FiltersSemVerV2PackageVersions()
             Assert.Equal(NonSemVer2Packages.Count, resultSet.Count);
         }
 
+        [Fact]
+        public async Task Get_FiltersOutUnavailablePackages()
+        {
+            // Arrange
+            var semVerLevel = "2.0.0";
+
+            // Act
+            var resultSet = await GetCollection<V2FeedPackage>(
+                (controller, options) => controller.Get(options, _curatedFeedName, semVerLevel),
+                $"/api/v2/curated-feed/{_curatedFeedName}/Packages?semVerLevel={semVerLevel}");
+
+            // Assert
+            AssertUnavailablePackagesFilteredFromResult(resultSet);
+            Assert.Equal(AvailablePackages.Count, resultSet.Count);
+        }
+
         [Theory]
         [InlineData("2.0.0")]
         [InlineData("2.0.1")]
@@ -44,7 +60,7 @@ public async Task Get_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrHigher(st
 
             // Assert
             AssertSemVer2PackagesIncludedInResult(resultSet, includePrerelease: true);
-            Assert.Equal(AllPackages.Count(), resultSet.Count);
+            Assert.Equal(AvailablePackages.Count, resultSet.Count);
         }
 
         [Fact]
@@ -72,7 +88,7 @@ public async Task GetCount_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrHigh
                 $"/api/v2/curated-feed/{_curatedFeedName}/Packages/$count?semVerLevel={semVerLevel}");
 
             // Assert
-            Assert.Equal(AllPackages.Count(), count);
+            Assert.Equal(AvailablePackages.Count, count);
         }
 
         [Fact]
@@ -102,7 +118,7 @@ public async Task FindPackagesById_IncludesSemVerV2PackageVersionsWhenSemVerLeve
 
             // Assert
             AssertSemVer2PackagesIncludedInResult(resultSet, includePrerelease: true);
-            Assert.Equal(AllPackages.Count(), resultSet.Count);
+            Assert.Equal(AvailablePackages.Count, resultSet.Count);
         }
 
         [Fact]
@@ -149,7 +165,7 @@ public async Task Search_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrHigher
 
             // Assert
             AssertSemVer2PackagesIncludedInResult(resultSet, includePrerelease: false);
-            Assert.Equal(AllPackages.Where(p => !p.IsPrerelease).Count(), resultSet.Count);
+            Assert.Equal(AvailablePackages.Where(p => !p.IsPrerelease).Count(), resultSet.Count);
         }
 
         [Theory]
@@ -171,7 +187,7 @@ public async Task Search_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrHigher
 
             // Assert
             AssertSemVer2PackagesIncludedInResult(resultSet, includePrerelease: true);
-            Assert.Equal(AllPackages.Count(), resultSet.Count);
+            Assert.Equal(AvailablePackages.Count, resultSet.Count);
         }
 
         [Fact]
@@ -258,7 +274,7 @@ public async Task SearchCount_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrH
                 $"/api/v2/curated-feed/{_curatedFeedName}/Search/$count?searchTerm='{TestPackageId}'&includePrerelease=true&semVerLevel={semVerLevel}");
 
             // Assert
-            Assert.Equal(AllPackages.Count(), searchCount);
+            Assert.Equal(AvailablePackages.Count, searchCount);
         }
 
         [Theory]
@@ -274,7 +290,7 @@ public async Task SearchCount_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrH
                 $"/api/v2/curated-feed/{_curatedFeedName}/Search/$count?searchTerm='{TestPackageId}'&semVerLevel={semVerLevel}");
 
             // Assert
-            Assert.Equal(AllPackages.Where(p => !p.IsPrerelease).Count(), searchCount);
+            Assert.Equal(AvailablePackages.Where(p => !p.IsPrerelease).Count(), searchCount);
         }
 
         protected override ODataV2CuratedFeedController CreateController(
@@ -312,6 +328,19 @@ private static IDbSet<T> GetQueryableMockDbSet<T>(params T[] sourceList) where T
             return dbSet.Object;
         }
 
+        private void AssertUnavailablePackagesFilteredFromResult(IEnumerable<V2FeedPackage> resultSet)
+        {
+            foreach (var feedPackage in resultSet)
+            {
+                Assert.Empty(UnavailablePackages.Where(p => string.Equals(p.Version, feedPackage.Version)));
+
+                // Assert each of the items in the result set is a non-SemVer v2.0.0 package
+                Assert.Single(AvailablePackages.Where(p =>
+                    string.Equals(p.Version, feedPackage.Version) &&
+                    string.Equals(p.PackageRegistration.Id, feedPackage.Id)));
+            }
+        }
+
         private void AssertSemVer2PackagesFilteredFromResult(IEnumerable<V2FeedPackage> resultSet)
         {
             foreach (var feedPackage in resultSet)
diff --git a/tests/NuGetGallery.Facts/Controllers/ODataV2FeedControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/ODataV2FeedControllerFacts.cs
index 892ec5adbc..311c842bc2 100644
--- a/tests/NuGetGallery.Facts/Controllers/ODataV2FeedControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/ODataV2FeedControllerFacts.cs
@@ -41,7 +41,7 @@ public async Task Get_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrHigher(st
 
             // Assert
             AssertSemVer2PackagesIncludedInResult(resultSet);
-            Assert.Equal(AllPackages.Count(), resultSet.Count);
+            Assert.Equal(AvailablePackages.Count, resultSet.Count);
         }
 
         [Fact]
@@ -69,7 +69,7 @@ public async Task GetCount_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrHigh
                 $"/api/v2/Packages/$count?semVerLevel={semVerLevel}");
 
             // Assert
-            Assert.Equal(AllPackages.Count(), count);
+            Assert.Equal(AvailablePackages.Count, count);
         }
 
         [Fact]
@@ -99,7 +99,7 @@ public async Task FindPackagesById_IncludesSemVerV2PackageVersionsWhenSemVerLeve
 
             // Assert
             AssertSemVer2PackagesIncludedInResult(resultSet);
-            Assert.Equal(AllPackages.Count(), resultSet.Count);
+            Assert.Equal(AvailablePackages.Count, resultSet.Count);
         }
 
         [Fact]
@@ -232,7 +232,7 @@ public async Task Search_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrHigher
 
             // Assert
             AssertSemVer2PackagesIncludedInResult(resultSet);
-            Assert.Equal(AllPackages.Count(), resultSet.Count);
+            Assert.Equal(AvailablePackages.Count, resultSet.Count);
         }
 
         [Fact]
@@ -267,7 +267,7 @@ public async Task SearchCount_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrH
                 $"/api/v2/Search/$count?searchTerm='{TestPackageId}'&includePrerelease=true&semVerLevel={semVerLevel}");
 
             // Assert
-            Assert.Equal(AllPackages.Count(), searchCount);
+            Assert.Equal(AvailablePackages.Count, searchCount);
         }
 
         [Fact]
@@ -298,7 +298,7 @@ public async Task GetUpdates_IncludesSemVerV2PackageVersionsWhenSemVerLevel2OrHi
             // Arrange
             const string currentVersionString = "1.0.0";
             var currentVersion = NuGetVersion.Parse(currentVersionString);
-            var expected = AllPackages.Where(p => NuGetVersion.Parse(p.Version) > currentVersion);
+            var expected = AvailablePackages.Where(p => NuGetVersion.Parse(p.Version) > currentVersion);
 
             // Act
             var resultSet = await GetCollection<V2FeedPackage>(
@@ -356,7 +356,7 @@ public async Task GetUpdatesCount_IncludesSemVerV2PackageVersionsWhenSemVerLevel
             // Arrange
             const string currentVersionString = "1.0.0";
             var currentVersion = NuGetVersion.Parse(currentVersionString);
-            var expected = AllPackages.Where(p => NuGetVersion.Parse(p.Version) > currentVersion);
+            var expected = AvailablePackages.Where(p => NuGetVersion.Parse(p.Version) > currentVersion);
 
             // Act
             var searchCount = await GetInt<V2FeedPackage>(

From f662ffe6dba7f80e6f4dec178a3c0bd335feb0b6 Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Tue, 26 Sep 2017 15:41:38 -0700
Subject: [PATCH 15/25] Implement "revalidate" gesture for asynchronous
 validation (#4747)

Address https://github.com/NuGet/Engineering/issues/765
---
 .../Controllers/PackagesController.cs         | 32 ++++++-
 .../Services/IValidationService.cs            | 11 ++-
 .../Services/ValidationService.cs             |  5 +
 src/NuGetGallery/UrlExtensions.cs             | 19 +++-
 .../Views/Packages/DisplayPackage.cshtml      |  8 ++
 .../Controllers/PackagesControllerFacts.cs    | 93 ++++++++++++++++++-
 .../Services/ValidationServiceFacts.cs        | 36 +++++++
 .../TestUtils/TestUtility.cs                  |  1 +
 8 files changed, 199 insertions(+), 6 deletions(-)

diff --git a/src/NuGetGallery/Controllers/PackagesController.cs b/src/NuGetGallery/Controllers/PackagesController.cs
index 4f4ed3aab0..c0cf00ed05 100644
--- a/src/NuGetGallery/Controllers/PackagesController.cs
+++ b/src/NuGetGallery/Controllers/PackagesController.cs
@@ -61,6 +61,7 @@ public partial class PackagesController
         private readonly IReservedNamespaceService _reservedNamespaceService;
         private readonly IPackageUploadService _packageUploadService;
         private readonly IReadMeService _readMeService;
+        private readonly IValidationService _validationService;
 
         public PackagesController(
             IPackageService packageService,
@@ -83,7 +84,8 @@ public PackagesController(
             ISecurityPolicyService securityPolicyService,
             IReservedNamespaceService reservedNamespaceService,
             IPackageUploadService packageUploadService,
-            IReadMeService readMeService)
+            IReadMeService readMeService,
+            IValidationService validationService)
         {
             _packageService = packageService;
             _packageOwnerRequestService = packageOwnerRequestService;
@@ -106,6 +108,7 @@ public PackagesController(
             _reservedNamespaceService = reservedNamespaceService;
             _packageUploadService = packageUploadService;
             _readMeService = readMeService;
+            _validationService = validationService;
         }
 
         [HttpGet]
@@ -956,6 +959,33 @@ public virtual async Task<ActionResult> Reflow(string id, string version)
             return SafeRedirect(Url.Package(id, version));
         }
 
+        [Authorize(Roles = "Admins")]
+        [RequiresAccountConfirmation("revalidate a package")]
+        public virtual async Task<ActionResult> Revalidate(string id, string version)
+        {
+            var package = _packageService.FindPackageByIdAndVersion(id, version);
+
+            if (package == null)
+            {
+                return HttpNotFound();
+            }
+            
+            try
+            {
+                await _validationService.RevalidateAsync(package);
+
+                TempData["Message"] = "The package is being revalidated.";
+            }
+            catch (Exception ex)
+            {
+                QuietLog.LogHandledException(ex);
+
+                TempData["Message"] = $"An error occurred while revalidating the package. {ex.Message}";
+            }
+
+            return SafeRedirect(Url.Package(id, version));
+        }
+
         [Authorize(Roles = "Admins")]
         [HttpPost]
         [RequiresAccountConfirmation("delete a package")]
diff --git a/src/NuGetGallery/Services/IValidationService.cs b/src/NuGetGallery/Services/IValidationService.cs
index 58fcbc6d12..898678ddbb 100644
--- a/src/NuGetGallery/Services/IValidationService.cs
+++ b/src/NuGetGallery/Services/IValidationService.cs
@@ -11,10 +11,17 @@ namespace NuGetGallery
     public interface IValidationService
     {
         /// <summary>
-        /// Starts the asynchronous validation for the provided package and puts the package in the correct state. The
-        /// commit to the database is the responsibility of the caller.
+        /// Starts the asynchronous validation for the provided new package and puts the package in the correct
+        /// <see cref="Package.PackageStatusKey"/>. The commit to the database is the responsibility of the caller.
         /// </summary>
         /// <param name="package">The package to start validation for.</param>
         Task StartValidationAsync(Package package);
+
+        /// <summary>
+        /// Starts the asynchronous validation for the provided new package but does not change the package's
+        /// <see cref="Package.PackageStatusKey"/>.
+        /// </summary>
+        /// <param name="package">The package to start validation for.</param>
+        Task RevalidateAsync(Package package);
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/ValidationService.cs b/src/NuGetGallery/Services/ValidationService.cs
index edcb5106b4..90629637d5 100644
--- a/src/NuGetGallery/Services/ValidationService.cs
+++ b/src/NuGetGallery/Services/ValidationService.cs
@@ -28,5 +28,10 @@ await _packageService.UpdatePackageStatusAsync(
                 packageStatus,
                 commitChanges: false);
         }
+
+        public async Task RevalidateAsync(Package package)
+        {
+            await _initiator.StartValidationAsync(package);
+        }
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/UrlExtensions.cs b/src/NuGetGallery/UrlExtensions.cs
index ffffbf44aa..2f492889c6 100644
--- a/src/NuGetGallery/UrlExtensions.cs
+++ b/src/NuGetGallery/UrlExtensions.cs
@@ -486,7 +486,24 @@ public static string ReflowPackage(
         {
             return GetActionLink(
                 url,
-                "Reflow",
+                nameof(PackagesController.Reflow),
+                "Packages",
+                relativeUrl,
+                routeValues: new RouteValueDictionary
+                {
+                    { "id", package.Id },
+                    { "version", package.Version }
+                });
+        }
+
+        public static string RevalidatePackage(
+            this UrlHelper url,
+            IPackageVersionModel package,
+            bool relativeUrl = true)
+        {
+            return GetActionLink(
+                url,
+                nameof(PackagesController.Revalidate),
                 "Packages",
                 relativeUrl,
                 routeValues: new RouteValueDictionary
diff --git a/src/NuGetGallery/Views/Packages/DisplayPackage.cshtml b/src/NuGetGallery/Views/Packages/DisplayPackage.cshtml
index e5dd57a8f1..99f3eb7457 100644
--- a/src/NuGetGallery/Views/Packages/DisplayPackage.cshtml
+++ b/src/NuGetGallery/Views/Packages/DisplayPackage.cshtml
@@ -566,6 +566,14 @@
                         <a href="@Url.ReflowPackage(Model)">Reflow package</a>
                     </li>
                 }
+
+                @if (!Model.Deleted && User.IsAdministrator() && Config.Current.AsynchronousPackageValidationEnabled)
+                {
+                    <li>
+                        <i class="ms-Icon ms-Icon--Refresh" aria-hidden="true"></i>
+                        <a href="@Url.RevalidatePackage(Model)">Revalidate package</a>
+                    </li>
+                }
             </ul>
             @if (Model.LicenseNames.AnySafe())
             {
diff --git a/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
index d86b45e984..17b6bc46fc 100644
--- a/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
@@ -53,7 +53,8 @@ private static PackagesController CreateController(
             Mock<ITelemetryService> telemetryService = null,
             Mock<ISecurityPolicyService> securityPolicyService = null,
             Mock<IReservedNamespaceService> reservedNamespaceService = null,
-            Mock<IPackageUploadService> packageUploadService = null)
+            Mock<IPackageUploadService> packageUploadService = null,
+            Mock<IValidationService> validationService = null)
         {
             packageService = packageService ?? new Mock<IPackageService>();
             packageOwnerRequestService = packageOwnerRequestService ?? new Mock<IPackageOwnerRequestService>();
@@ -109,6 +110,8 @@ private static PackagesController CreateController(
                     return packageService.Object.CreatePackageAsync(nugetPackage, packageStreamMetadata, user, isVerified: false);
                 });
 
+            validationService = validationService ?? new Mock<IValidationService>();
+
             var controller = new Mock<PackagesController>(
                 packageService.Object,
                 packageOwnerRequestService.Object,
@@ -130,7 +133,8 @@ private static PackagesController CreateController(
                 securityPolicyService.Object,
                 reservedNamespaceService.Object,
                 packageUploadService.Object,
-                new ReadMeService(packageFileService.Object));
+                new ReadMeService(packageFileService.Object),
+                validationService.Object);
 
             controller.CallBase = true;
             controller.Object.SetOwinContextOverride(Fakes.CreateOwinContext());
@@ -2833,6 +2837,91 @@ public async Task IndexingAndPackageServicesAreUpdated()
                 Assert.Equal(@"~\Bar.cshtml", ((RedirectResult)result).Url);
             }
         }
+
+        public class TheRevalidateMethod : TestContainer
+        {
+            private  Package _package;
+            private readonly Mock<IPackageService> _packageService;
+            private readonly Mock<IValidationService> _validationService;
+            private readonly TestGalleryConfigurationService _configurationService;
+            private readonly PackagesController _target;
+
+            public TheRevalidateMethod()
+            {
+                _package = new Package
+                {
+                    PackageRegistration = new PackageRegistration { Id = "NuGet.Versioning" },
+                    Version = "3.4.0",
+                };
+
+                _packageService = new Mock<IPackageService>();
+                _packageService
+                    .Setup(svc => svc.FindPackageByIdAndVersion(
+                        It.IsAny<string>(),
+                        It.IsAny<string>(),
+                        It.IsAny<int?>(),
+                        It.IsAny<bool>()))
+                    .Returns(_package);
+
+                _validationService = new Mock<IValidationService>();
+
+                _configurationService = GetConfigurationService();
+
+                _target = CreateController(
+                    _configurationService,
+                    packageService: _packageService,
+                    validationService: _validationService);
+            }
+
+            [Fact]
+            public async Task RevalidateIsCalledWithTheExistingPackage()
+            {
+                // Arrange & Act
+                await _target.Revalidate(
+                    _package.PackageRegistration.Id,
+                    _package.Version);
+
+                // Assert
+                _validationService.Verify(
+                    x => x.RevalidateAsync(_package),
+                    Times.Once);
+            }
+
+            [Fact]
+            public async Task RedirectsAfterRevalidatingPackage()
+            {
+                // Arrange & Act
+                var result = await _target.Revalidate(
+                    _package.PackageRegistration.Id,
+                    _package.Version);
+
+                // Assert
+                var redirect = Assert.IsType<SafeRedirectResult>(result);
+                Assert.Equal($"/?id={_package.PackageRegistration.Id}&version={_package.Version}", redirect.Url);
+                Assert.Equal("/", redirect.SafeUrl);
+            }
+
+            [Fact]
+            public async Task ReturnsNotFoundForUnknownPackage()
+            {
+                // Arrange
+                _packageService
+                    .Setup(svc => svc.FindPackageByIdAndVersion(
+                        It.IsAny<string>(),
+                        It.IsAny<string>(),
+                        It.IsAny<int?>(),
+                        It.IsAny<bool>()))
+                    .Returns<Package>(null);
+
+                // Act
+                var result = await _target.Revalidate(
+                    _package.PackageRegistration.Id,
+                    _package.Version);
+
+                // Assert
+                Assert.IsType<HttpNotFoundResult>(result);
+            }
+        }
     }
 }
 
diff --git a/tests/NuGetGallery.Facts/Services/ValidationServiceFacts.cs b/tests/NuGetGallery.Facts/Services/ValidationServiceFacts.cs
index a9656459eb..38aec25db9 100644
--- a/tests/NuGetGallery.Facts/Services/ValidationServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/ValidationServiceFacts.cs
@@ -45,6 +45,42 @@ public async Task UpdatesThePackageStatus()
             }
         }
 
+        public class TheRevalidateMethod : FactsBase
+        {
+            [Fact]
+            public async Task InitiatesTheValidation()
+            {
+                // Arrange & Act
+                await _target.RevalidateAsync(_package);
+
+                // Assert
+                _initiator.Verify(x => x.StartValidationAsync(_package), Times.Once);
+            }
+
+            [Fact]
+            public async Task DoesNotChangeThePackageStatus()
+            {
+                // Arrange
+                var packageStatus = PackageStatus.Validating;
+                _package.PackageStatusKey = PackageStatus.Available;
+                _initiator
+                    .Setup(x => x.StartValidationAsync(It.IsAny<Package>()))
+                    .ReturnsAsync(packageStatus);
+
+                // Act
+                await _target.RevalidateAsync(_package);
+
+                // Assert
+                _packageService.Verify(
+                    x => x.UpdatePackageStatusAsync(It.IsAny<Package>(), It.IsAny<PackageStatus>(), It.IsAny<bool>()),
+                    Times.Never);
+
+                /// The implementation should not change the package status on its own. It should depend on 
+                /// <see cref="IPackageService"/> to do this.
+                Assert.Equal(PackageStatus.Available, _package.PackageStatusKey);
+            }
+        }
+
         public class FactsBase
         {
             protected readonly Mock<IPackageService> _packageService;
diff --git a/tests/NuGetGallery.Facts/TestUtils/TestUtility.cs b/tests/NuGetGallery.Facts/TestUtils/TestUtility.cs
index cf3d61ec9c..09d070f8e1 100644
--- a/tests/NuGetGallery.Facts/TestUtils/TestUtility.cs
+++ b/tests/NuGetGallery.Facts/TestUtils/TestUtility.cs
@@ -45,6 +45,7 @@ public static Mock<HttpContextBase> SetupHttpContextMockForUrlGeneration(Mock<Ht
             controller.ControllerContext = controllerContext;
             var routeCollection = new RouteCollection();
             routeCollection.MapRoute("catch-all", "{*catchall}");
+            routeCollection.MapRoute(RouteName.Home, "");
             routeCollection.MapRoute(RouteName.DisplayPackage, "");
             controller.Url = new UrlHelper(requestContext, routeCollection);
             return httpContext;

From 41b6693f5e471b366dfc41e3328259d66bf5be7b Mon Sep 17 00:00:00 2001
From: Svetlana Kofman <skofman@microsoft.com>
Date: Wed, 27 Sep 2017 14:20:16 -0700
Subject: [PATCH 16/25] Add support for default security policy (#4758)

* Add feature flag
* Change error messages to be more general for the default policy case
* Use protocol everywhere
---
 .../Configuration/AppConfiguration.cs         |   5 +
 .../Configuration/IAppConfiguration.cs        |   5 +
 .../Controllers/JsonApiController.cs          |   2 +-
 .../Controllers/PackagesController.cs         |   4 +-
 src/NuGetGallery/NuGetGallery.csproj          |   2 +
 .../Security/DefaultSubscription.cs           |  47 ++++++
 .../RequireMinClientVersionForPushPolicy.cs   |   3 +-
 .../RequireMinProtocolVersionForPushPolicy.cs | 106 ++++++++++++++
 .../Security/SecurePushSubscription.cs        |   4 +-
 .../Security/SecurityPolicyService.cs         |  49 ++++++-
 .../Security/UserSecurityPolicyHandler.cs     |   1 -
 src/NuGetGallery/Strings.Designer.cs          |   8 +-
 src/NuGetGallery/Strings.resx                 |   8 +-
 src/NuGetGallery/Web.config                   |   1 +
 .../NuGetGallery.Facts.csproj                 |   1 +
 ...quireMinClientVersionForPushPolicyFacts.cs |   3 +
 ...ireMinProtocolVersionForPushPolicyFacts.cs | 135 ++++++++++++++++++
 .../Security/SecurePushSubscriptionFacts.cs   |   2 +-
 .../Security/SecurityPolicyServiceFacts.cs    | 130 +++++++++++++++--
 .../Security/TestSecurityPolicyService.cs     |  15 +-
 .../Security/TestUserSecurityPolicyData.cs    |  62 +++++---
 21 files changed, 536 insertions(+), 57 deletions(-)
 create mode 100644 src/NuGetGallery/Security/DefaultSubscription.cs
 create mode 100644 src/NuGetGallery/Security/RequireMinProtocolVersionForPushPolicy.cs
 create mode 100644 tests/NuGetGallery.Facts/Security/RequireMinProtocolVersionForPushPolicyFacts.cs

diff --git a/src/NuGetGallery/Configuration/AppConfiguration.cs b/src/NuGetGallery/Configuration/AppConfiguration.cs
index f844cbb430..c73ae77678 100644
--- a/src/NuGetGallery/Configuration/AppConfiguration.cs
+++ b/src/NuGetGallery/Configuration/AppConfiguration.cs
@@ -272,5 +272,10 @@ public class AppConfiguration : IAppConfiguration
         /// Get/Sets a string to a url that details trademarks. If unset, the link will not appear.
         /// </summary>
         public string TrademarksUrl { get; set; }
+
+        /// <summary>
+        /// Gets/Sets a flag indicating if default security policies should be enforced.
+        /// </summary>
+        public bool EnforceDefaultSecurityPolicies { get; set; }
     }
 }
diff --git a/src/NuGetGallery/Configuration/IAppConfiguration.cs b/src/NuGetGallery/Configuration/IAppConfiguration.cs
index fa08a8cabe..37b49d6f84 100644
--- a/src/NuGetGallery/Configuration/IAppConfiguration.cs
+++ b/src/NuGetGallery/Configuration/IAppConfiguration.cs
@@ -273,5 +273,10 @@ public interface IAppConfiguration
         /// Get/Sets a string to a url that details trademarks. If unset, the link will not appear.
         /// </summary>
         string TrademarksUrl { get; set; }
+
+        /// <summary>
+        /// Gets/Sets a flag indicating if default security policies should be enforced.
+        /// </summary>
+        bool EnforceDefaultSecurityPolicies { get; set; }
     }
 }
diff --git a/src/NuGetGallery/Controllers/JsonApiController.cs b/src/NuGetGallery/Controllers/JsonApiController.cs
index f5fea3f655..6f1ce11734 100644
--- a/src/NuGetGallery/Controllers/JsonApiController.cs
+++ b/src/NuGetGallery/Controllers/JsonApiController.cs
@@ -266,7 +266,7 @@ private IEnumerable<string> GetPendingPropagatingOwners(PackageRegistration pack
         private string GetSecurePushPolicyDescriptions()
         {
             return string.Format(CultureInfo.CurrentCulture, Strings.SecurePushPolicyDescriptionsHtml,
-                SecurePushSubscription.MinClientVersion, SecurePushSubscription.PushKeysExpirationInDays);
+                SecurePushSubscription.MinProtocolVersion, SecurePushSubscription.PushKeysExpirationInDays);
         }
 
         private bool TryGetManagePackageOwnerModel(string id, string username, out ManagePackageOwnerModel model)
diff --git a/src/NuGetGallery/Controllers/PackagesController.cs b/src/NuGetGallery/Controllers/PackagesController.cs
index c0cf00ed05..bf95b85f2b 100644
--- a/src/NuGetGallery/Controllers/PackagesController.cs
+++ b/src/NuGetGallery/Controllers/PackagesController.cs
@@ -531,7 +531,7 @@ private string GetDisplayPackagePolicyMessage(PackageRegistration package)
                     return string.Format(CultureInfo.CurrentCulture,
                         Strings.DisplayPackage_SecurePushRequired,
                         string.Join(", ", propagators.Select(u => u.Username)),
-                        SecurePushSubscription.MinClientVersion,
+                        SecurePushSubscription.MinProtocolVersion,
                         _config.GalleryOwner.Address);
                 }
             }
@@ -1336,7 +1336,7 @@ private async Task<Tuple<List<User>, List<User>>> HandleSecurePushPropagation(Pa
         private string GetSecurePushPolicyDescriptions()
         {
             return string.Format(CultureInfo.CurrentCulture, Strings.SecurePushPolicyDescriptions,
-                SecurePushSubscription.MinClientVersion, SecurePushSubscription.PushKeysExpirationInDays);
+                SecurePushSubscription.MinProtocolVersion, SecurePushSubscription.PushKeysExpirationInDays);
         }
 
         private async Task<bool> SubscribeToSecurePushAsync(User user)
diff --git a/src/NuGetGallery/NuGetGallery.csproj b/src/NuGetGallery/NuGetGallery.csproj
index abcf1d9adb..174afb6126 100644
--- a/src/NuGetGallery/NuGetGallery.csproj
+++ b/src/NuGetGallery/NuGetGallery.csproj
@@ -826,6 +826,8 @@
       <DependentUpon>201709202249402_AddPackageOwnershipRequestsPage.cs</DependentUpon>
     </Compile>
     <Compile Include="RequestModels\ReadMeRequest.cs" />
+    <Compile Include="Security\DefaultSubscription.cs" />
+    <Compile Include="Security\RequireMinProtocolVersionForPushPolicy.cs" />
     <Compile Include="Security\RequireSecurePushForCoOwnersPolicy.cs" />
     <Compile Include="Security\SecurePushSubscription.cs" />
     <Compile Include="Security\IUserSecurityPolicySubscription.cs" />
diff --git a/src/NuGetGallery/Security/DefaultSubscription.cs b/src/NuGetGallery/Security/DefaultSubscription.cs
new file mode 100644
index 0000000000..4032bc7dbc
--- /dev/null
+++ b/src/NuGetGallery/Security/DefaultSubscription.cs
@@ -0,0 +1,47 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using NuGet.Versioning;
+
+namespace NuGetGallery.Security
+{
+    public class DefaultSubscription : IUserSecurityPolicySubscription
+    {
+        private Lazy<List<UserSecurityPolicy>> _policies = new Lazy<List<UserSecurityPolicy>>(InitializePoliciesList, isThreadSafe: true);
+
+        internal const string MinProtocolVersion = "4.1.0";
+        internal const string Name = "Default";
+
+        /// <summary>
+        /// Subscription name.
+        /// </summary>
+        public string SubscriptionName => Name;
+
+        /// <summary>
+        /// Required policies for this subscription.
+        /// </summary>
+        public IEnumerable<UserSecurityPolicy> Policies => _policies.Value;
+
+        public Task OnSubscribeAsync(UserSecurityPolicySubscriptionContext context)
+        {
+            throw new NotSupportedException();
+        }
+
+        public Task OnUnsubscribeAsync(UserSecurityPolicySubscriptionContext context)
+        {
+            throw new NotSupportedException();
+        }
+
+        private static List<UserSecurityPolicy> InitializePoliciesList()
+        {
+            return new List<UserSecurityPolicy>()
+            {
+                new UserSecurityPolicy(RequirePackageVerifyScopePolicy.PolicyName, Name),
+                RequireMinProtocolVersionForPushPolicy.CreatePolicy(Name, new NuGetVersion(MinProtocolVersion))
+            };
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Security/RequireMinClientVersionForPushPolicy.cs b/src/NuGetGallery/Security/RequireMinClientVersionForPushPolicy.cs
index dab36ad9ed..0ccd491ed8 100644
--- a/src/NuGetGallery/Security/RequireMinClientVersionForPushPolicy.cs
+++ b/src/NuGetGallery/Security/RequireMinClientVersionForPushPolicy.cs
@@ -11,6 +11,7 @@
 namespace NuGetGallery.Security
 {
     /// <summary>
+    /// This code should be removed soon: https://github.com/NuGet/Engineering/issues/800
     /// User security policy that requires a minimum client version in order to push packages.
     /// </summary>
     public class RequireMinClientVersionForPushPolicy : UserSecurityPolicyHandler
@@ -98,7 +99,7 @@ public override SecurityPolicyResult Evaluate(UserSecurityPolicyEvaluationContex
             if (protocolVersion == null || protocolVersion < minClientVersion)
             {
                 return SecurityPolicyResult.CreateErrorResult(string.Format(CultureInfo.CurrentCulture,
-                    Strings.SecurityPolicy_RequireMinClientVersionForPush, minClientVersion));
+                    Strings.SecurityPolicy_RequireMinProtocolVersionForPush, minClientVersion));
             }
 
             return SecurityPolicyResult.SuccessResult;
diff --git a/src/NuGetGallery/Security/RequireMinProtocolVersionForPushPolicy.cs b/src/NuGetGallery/Security/RequireMinProtocolVersionForPushPolicy.cs
new file mode 100644
index 0000000000..bc529ebfdb
--- /dev/null
+++ b/src/NuGetGallery/Security/RequireMinProtocolVersionForPushPolicy.cs
@@ -0,0 +1,106 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Globalization;
+using System.Linq;
+using Newtonsoft.Json;
+using NuGet.Protocol;
+using NuGet.Versioning;
+
+namespace NuGetGallery.Security
+{
+    /// <summary>
+    /// User security policy that requires a minimum protocol version in order to push packages.
+    /// </summary>
+    public class RequireMinProtocolVersionForPushPolicy : UserSecurityPolicyHandler
+    {
+        public const string PolicyName = nameof(RequireMinProtocolVersionForPushPolicy);
+
+        public class State
+        {
+            [JsonProperty("v")]
+            [JsonConverter(typeof(NuGetVersionConverter))]
+            public NuGetVersion MinProtocolVersion { get; set; }
+        }
+
+        public RequireMinProtocolVersionForPushPolicy()
+            : base(PolicyName, SecurityPolicyAction.PackagePush)
+        {
+        }
+
+        /// <summary>
+        /// Create a user security policy that requires a minimum protocol version.
+        /// </summary>
+        public static UserSecurityPolicy CreatePolicy(string subscription, NuGetVersion minProtocolVersion)
+        {
+            var value = JsonConvert.SerializeObject(new State()
+            {
+                MinProtocolVersion = minProtocolVersion
+            });
+
+            return new UserSecurityPolicy(PolicyName, subscription, value);
+        }
+
+        /// <summary>
+        /// In case of multiple, select the max of the minimum required protocol versions.
+        /// </summary>
+        private NuGetVersion GetMaxOfMinProtocolVersions(UserSecurityPolicyEvaluationContext context)
+        {
+            var policyStates = context.Policies
+                .Where(p => !string.IsNullOrEmpty(p.Value))
+                .Select(p => JsonConvert.DeserializeObject<State>(p.Value));
+            return policyStates.Max(s => s.MinProtocolVersion);
+        }
+
+        /// <summary>
+        /// Get the current client version from the request. This header is DEPRECATED, and here for backwards compatibility!
+        /// </summary>
+        private NuGetVersion GetClientVersion(UserSecurityPolicyEvaluationContext context)
+        {
+            var clientVersionString = context.HttpContext.Request?.Headers[Constants.ClientVersionHeaderName];
+
+            return NuGetVersion.TryParse(clientVersionString, out NuGetVersion clientVersion) ? clientVersion : null;
+        }
+
+        /// <summary>
+        /// Get the current protocol version from the request.
+        /// </summary>
+        private NuGetVersion GetProtocolVersion(UserSecurityPolicyEvaluationContext context)
+        {
+            var protocolVersionString = context.HttpContext.Request?.Headers[Constants.NuGetProtocolHeaderName];
+
+            return NuGetVersion.TryParse(protocolVersionString, out NuGetVersion protocolVersion) ? protocolVersion : null;
+        }
+
+        /// <summary>
+        /// Evaluate if this security policy is met.
+        /// </summary>
+        public override SecurityPolicyResult Evaluate(UserSecurityPolicyEvaluationContext context)
+        {
+            if (context == null)
+            {
+                throw new ArgumentNullException(nameof(context));
+            }
+
+            var minProtocolVersion = GetMaxOfMinProtocolVersions(context);
+
+            // Do we have X-NuGet-Protocol-Version header?
+            var protocolVersion = GetProtocolVersion(context);
+
+            if (protocolVersion == null)
+            {
+                // Do we have X-NuGet-Client-Version header? This header is DEPRECATED, and here for backwards compatibility!
+                protocolVersion = GetClientVersion(context);
+            }
+
+            if (protocolVersion == null || protocolVersion < minProtocolVersion)
+            {
+                return SecurityPolicyResult.CreateErrorResult(string.Format(CultureInfo.CurrentCulture,
+                    Strings.SecurityPolicy_RequireMinProtocolVersionForPush, minProtocolVersion));
+            }
+
+            return SecurityPolicyResult.SuccessResult;
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Security/SecurePushSubscription.cs b/src/NuGetGallery/Security/SecurePushSubscription.cs
index e449ce4838..8425a90d02 100644
--- a/src/NuGetGallery/Security/SecurePushSubscription.cs
+++ b/src/NuGetGallery/Security/SecurePushSubscription.cs
@@ -18,7 +18,7 @@ namespace NuGetGallery.Security
     public class SecurePushSubscription : IUserSecurityPolicySubscription
     {
         public const string Name = "SecurePush";
-        internal const string MinClientVersion = "4.1.0";
+        internal const string MinProtocolVersion = "4.1.0";
         internal const int PushKeysExpirationInDays = 30;
 
         private IAuditingService _auditing;
@@ -43,7 +43,7 @@ public IEnumerable<UserSecurityPolicy> Policies
             get
             {
                 yield return new UserSecurityPolicy(RequirePackageVerifyScopePolicy.PolicyName, SubscriptionName);
-                yield return RequireMinClientVersionForPushPolicy.CreatePolicy(SubscriptionName, new NuGetVersion(MinClientVersion));
+                yield return RequireMinProtocolVersionForPushPolicy.CreatePolicy(SubscriptionName, new NuGetVersion(MinProtocolVersion));
             }
         }
 
diff --git a/src/NuGetGallery/Security/SecurityPolicyService.cs b/src/NuGetGallery/Security/SecurityPolicyService.cs
index be8272ae69..6453501ab4 100644
--- a/src/NuGetGallery/Security/SecurityPolicyService.cs
+++ b/src/NuGetGallery/Security/SecurityPolicyService.cs
@@ -6,7 +6,9 @@
 using System.Linq;
 using System.Threading.Tasks;
 using System.Web;
+using NuGet.Versioning;
 using NuGetGallery.Auditing;
+using NuGetGallery.Configuration;
 using NuGetGallery.Diagnostics;
 
 namespace NuGetGallery.Security
@@ -18,22 +20,26 @@ public class SecurityPolicyService : ISecurityPolicyService
     {
         private static Lazy<IEnumerable<UserSecurityPolicyHandler>> _userHandlers =
             new Lazy<IEnumerable<UserSecurityPolicyHandler>>(CreateUserHandlers);
-        
+
         protected IEntitiesContext EntitiesContext { get; set; }
 
         protected IAuditingService Auditing { get; set; }
 
         protected IDiagnosticsSource Diagnostics { get; set; }
 
+        protected IAppConfiguration Configuration { get; set; }
+
         protected SecurePushSubscription SecurePush { get; set; }
 
+        protected IUserSecurityPolicySubscription DefaultSubscription { get; set; }
+
         protected RequireSecurePushForCoOwnersPolicy SecurePushForCoOwners { get; set; }
 
         protected SecurityPolicyService()
         {
         }
 
-        public SecurityPolicyService(IEntitiesContext entitiesContext, IAuditingService auditing, IDiagnosticsService diagnostics,
+        public SecurityPolicyService(IEntitiesContext entitiesContext, IAuditingService auditing, IDiagnosticsService diagnostics, IAppConfiguration configuration,
             SecurePushSubscription securePush = null, RequireSecurePushForCoOwnersPolicy securePushForCoOwners = null)
         {
             EntitiesContext = entitiesContext ?? throw new ArgumentNullException(nameof(entitiesContext));
@@ -47,6 +53,8 @@ public SecurityPolicyService(IEntitiesContext entitiesContext, IAuditingService
             }
 
             Diagnostics = diagnostics.SafeGetSource(nameof(SecurityPolicyService));
+            Configuration = configuration ?? throw new ArgumentNullException(nameof(configuration));
+            DefaultSubscription = new DefaultSubscription();
         }
 
         /// <summary>
@@ -82,21 +90,47 @@ public async Task<SecurityPolicyResult> EvaluateAsync(SecurityPolicyAction actio
                 throw new ArgumentNullException(nameof(httpContext));
             }
 
+            // Evaluate default policies
+            if (Configuration.EnforceDefaultSecurityPolicies)
+            {
+                var defaultPolicies = DefaultSubscription.Policies;
+
+                var result = await EvaluateInternalAsync(defaultPolicies, httpContext, action, auditSuccess: false);
+                
+                if (!result.Success)
+                {
+                    return result;
+                }
+            }
+
+            // Evaluate user specific policies
             var user = httpContext.GetCurrentUser();
-            foreach (var handler in UserHandlers.Where(h => h.Action == action))
+            return await EvaluateInternalAsync(user.SecurityPolicies, httpContext, action, auditSuccess: true);
+        }
+
+        private async Task<SecurityPolicyResult> EvaluateInternalAsync(IEnumerable<UserSecurityPolicy> policies, HttpContextBase httpContext, SecurityPolicyAction action, bool auditSuccess)
+        {
+            var relevantHandlers = UserHandlers.Where(h => h.Action == action).ToList();
+
+            foreach (var handler in relevantHandlers)
             {
-                var foundPolicies = user.SecurityPolicies.Where(p => p.Name.Equals(handler.Name, StringComparison.OrdinalIgnoreCase));
+                var foundPolicies = policies.Where(p => p.Name.Equals(handler.Name, StringComparison.OrdinalIgnoreCase)).ToList();
+
                 if (foundPolicies.Any())
                 {
+                    var user = httpContext.GetCurrentUser();
                     var result = handler.Evaluate(new UserSecurityPolicyEvaluationContext(httpContext, foundPolicies));
 
-                    await Auditing.SaveAuditRecordAsync(new UserSecurityPolicyAuditRecord(
+                    if (auditSuccess || !result.Success)
+                    {
+                        await Auditing.SaveAuditRecordAsync(new UserSecurityPolicyAuditRecord(
                         user.Username, GetAuditAction(action), foundPolicies, result.Success, result.ErrorMessage));
+                    }
 
                     if (!result.Success)
                     {
                         Diagnostics.Information(
-                            $"Security policy '{handler.Name}' failed for user '{user.Username}' with error '{result.ErrorMessage}'.");
+                        $"Security policy from subscription '{foundPolicies.First().Subscription}' - '{handler.Name}' failed for user '{user.Username}' with error '{result.ErrorMessage}'.");
 
                         return result;
                     }
@@ -291,6 +325,7 @@ private static IEnumerable<UserSecurityPolicyHandler> CreateUserHandlers()
         {
             yield return new RequireMinClientVersionForPushPolicy();
             yield return new RequirePackageVerifyScopePolicy();
+            yield return new RequireMinProtocolVersionForPushPolicy();
         }
-    }
+   }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/Security/UserSecurityPolicyHandler.cs b/src/NuGetGallery/Security/UserSecurityPolicyHandler.cs
index 19a069b3a3..ab74e20bf8 100644
--- a/src/NuGetGallery/Security/UserSecurityPolicyHandler.cs
+++ b/src/NuGetGallery/Security/UserSecurityPolicyHandler.cs
@@ -2,7 +2,6 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
-using NuGetGallery.Filters;
 
 namespace NuGetGallery.Security
 {
diff --git a/src/NuGetGallery/Strings.Designer.cs b/src/NuGetGallery/Strings.Designer.cs
index 8c525c3b2e..8dee9c92f0 100644
--- a/src/NuGetGallery/Strings.Designer.cs
+++ b/src/NuGetGallery/Strings.Designer.cs
@@ -1147,7 +1147,7 @@ public static string SecurePushPolicyDescriptionsHtml {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to Your account requires a package verification key to push symbols. Please contact support@nuget.org to get more details..
+        ///   Looks up a localized string similar to A package verification key is required to push symbols. Please contact support@nuget.org to get more details..
         /// </summary>
         public static string SecurityPolicy_RequireApiKeyWithPackageVerifyScope {
             get {
@@ -1156,11 +1156,11 @@ public static string SecurityPolicy_RequireApiKeyWithPackageVerifyScope {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to Your account requires client version &apos;{0}&apos; or higher to be able to push packages. Please contact support@nuget.org to get more details..
+        ///   Looks up a localized string similar to A client version &apos;{0}&apos; or higher is required to be able to push packages. Please contact support@nuget.org to get more details..
         /// </summary>
-        public static string SecurityPolicy_RequireMinClientVersionForPush {
+        public static string SecurityPolicy_RequireMinProtocolVersionForPush {
             get {
-                return ResourceManager.GetString("SecurityPolicy_RequireMinClientVersionForPush", resourceCulture);
+                return ResourceManager.GetString("SecurityPolicy_RequireMinProtocolVersionForPush", resourceCulture);
             }
         }
         
diff --git a/src/NuGetGallery/Strings.resx b/src/NuGetGallery/Strings.resx
index 58ac6911b5..b99a11cf0e 100644
--- a/src/NuGetGallery/Strings.resx
+++ b/src/NuGetGallery/Strings.resx
@@ -432,10 +432,10 @@ The {1} Team</value>
     <value>A nuget package's {0} property is required.</value>
   </data>
   <data name="SecurityPolicy_RequireApiKeyWithPackageVerifyScope" xml:space="preserve">
-    <value>Your account requires a package verification key to push symbols. Please contact support@nuget.org to get more details.</value>
+    <value>A package verification key is required to push symbols. Please contact support@nuget.org to get more details.</value>
   </data>
-  <data name="SecurityPolicy_RequireMinClientVersionForPush" xml:space="preserve">
-    <value>Your account requires client version '{0}' or higher to be able to push packages. Please contact support@nuget.org to get more details.</value>
+  <data name="SecurityPolicy_RequireMinProtocolVersionForPush" xml:space="preserve">
+    <value>A client version '{0}' or higher is required to be able to push packages. Please contact support@nuget.org to get more details.</value>
   </data>
   <data name="PackageVersionDiffersOnlyByMetadataAndCannotBeModified" xml:space="preserve">
     <value>Package versions that differ only by metadata cannot be uploaded. A package with ID '{0}' and version '{1}' already exists and cannot be modified.</value>
@@ -562,7 +562,7 @@ For more information, please contact '{2}'.</value>
     <value>User not found with username '{0}'</value>
   </data>
   <data name="ReservedNamespace_ReservedIndicatorTooltip" xml:space="preserve">
-    <value>The ID prefix of this package has been reserved for one of the owner of this package by NuGet.org.</value>
+    <value>The ID prefix of this package has been reserved for one of the owners of this package by NuGet.org.</value>
   </data>
   <data name="UploadPackage_IdNamespaceConflict" xml:space="preserve">
     <value>This package ID has been reserved. Please request access to upload to this reserved namespace from the owner of the reserved prefix, or re-upload the package with a different ID.</value>
diff --git a/src/NuGetGallery/Web.config b/src/NuGetGallery/Web.config
index e04a4bbf45..f25c119393 100644
--- a/src/NuGetGallery/Web.config
+++ b/src/NuGetGallery/Web.config
@@ -142,6 +142,7 @@
     <add key="Gallery.ExternalBrandingUrl" value="" />
     <add key="Gallery.ExternalBrandingMessage" value="" />
     <add key="Gallery.TrademarksUrl" value="" />
+    <add key="Gallery.EnforceDefaultSecurityPolicies" value="false" />
 
     <!-- This is also the default so you can remove this setting if you really want. -->
     <!-- Set this to false if you want to disable search indexing in the background. -->
diff --git a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
index 3adf8d1789..fb05313a19 100644
--- a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
+++ b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
@@ -423,6 +423,7 @@
     <Compile Include="Controllers\UsersControllerFacts.cs" />
     <Compile Include="Framework\TestGalleryConfigurationService.cs" />
     <Compile Include="Helpers\HtmlExtensionsFacts.cs" />
+    <Compile Include="Security\RequireMinProtocolVersionForPushPolicyFacts.cs" />
     <Compile Include="Services\PackageOwnerRequestServiceFacts.cs" />
     <Compile Include="Services\ReadMeServiceFacts.cs" />
     <Compile Include="Infrastructure\UserAuditRecordFacts.cs" />
diff --git a/tests/NuGetGallery.Facts/Security/RequireMinClientVersionForPushPolicyFacts.cs b/tests/NuGetGallery.Facts/Security/RequireMinClientVersionForPushPolicyFacts.cs
index 8d7c3077eb..37c73d3b8c 100644
--- a/tests/NuGetGallery.Facts/Security/RequireMinClientVersionForPushPolicyFacts.cs
+++ b/tests/NuGetGallery.Facts/Security/RequireMinClientVersionForPushPolicyFacts.cs
@@ -10,6 +10,9 @@
 
 namespace NuGetGallery.Security
 {
+    /// <summary>
+    /// This code should be removed soon: https://github.com/NuGet/Engineering/issues/800
+    /// </summary>
     public class RequireMinClientVersionForPushPolicyFacts
     {
         [Theory]
diff --git a/tests/NuGetGallery.Facts/Security/RequireMinProtocolVersionForPushPolicyFacts.cs b/tests/NuGetGallery.Facts/Security/RequireMinProtocolVersionForPushPolicyFacts.cs
new file mode 100644
index 0000000000..8299e504c2
--- /dev/null
+++ b/tests/NuGetGallery.Facts/Security/RequireMinProtocolVersionForPushPolicyFacts.cs
@@ -0,0 +1,135 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Collections.Specialized;
+using System.Linq;
+using System.Web;
+using Moq;
+using NuGet.Versioning;
+using Xunit;
+
+namespace NuGetGallery.Security
+{
+    public class RequireMinProtocolVersionForPushPolicyFacts
+    {
+        [Theory]
+        [InlineData("4.1.0")]
+        [InlineData("3.0.0")]
+        [InlineData("2.0.0,4.1.0")]
+        [InlineData("4.1.0-beta1")]
+        public void Evaluate_ReturnsSuccessIfClientVersionEqualOrHigherThanRequired(string minProtocolVersions)
+        {
+            // Arrange & Act
+            var result = Evaluate(minProtocolVersions, actualClientVersion: "4.1.0", actualProtocolVersion: string.Empty);
+
+            // Assert
+            Assert.True(result.Success);
+            Assert.Null(result.ErrorMessage);
+        }
+
+        [Theory]
+        [InlineData("4.1.0")]
+        [InlineData("3.0.0")]
+        [InlineData("2.0.0,4.1.0")]
+        [InlineData("2.5.0")]
+        public void Evaluate_ReturnsFailureIfClientVersionLowerThanRequired(string minProtocolVersions)
+        {
+            // Arrange & Act
+            var result = Evaluate(minProtocolVersions, actualClientVersion: "2.5.0-beta1", actualProtocolVersion: string.Empty);
+
+            // Assert
+            Assert.False(result.Success);
+            Assert.NotNull(result.ErrorMessage);
+        }
+
+        [Theory]
+        [InlineData("4.1.0")]
+        [InlineData("3.0.0")]
+        [InlineData("2.0.0,4.1.0")]
+        [InlineData("4.1.0-beta1")]
+        public void Evaluate_ReturnsSuccessIfProtocolVersionEqualOrHigherThanRequired(string minProtocolVersions)
+        {
+            // Arrange & Act
+            var result = Evaluate(minProtocolVersions, actualClientVersion: string.Empty, actualProtocolVersion: "4.1.0");
+
+            // Assert
+            Assert.True(result.Success);
+            Assert.Null(result.ErrorMessage);
+        }
+
+        [Theory]
+        [InlineData("4.1.0")]
+        [InlineData("3.0.0")]
+        [InlineData("2.0.0,4.1.0")]
+        [InlineData("2.5.0")]
+        public void Evaluate_ReturnsFailureIfProtocolVersionLowerThanRequired(string minProtocolVersions)
+        {
+            // Arrange & Act
+            var result = Evaluate(minProtocolVersions, actualClientVersion: string.Empty, actualProtocolVersion: "2.5.0-beta1");
+
+            // Assert
+            Assert.False(result.Success);
+            Assert.NotNull(result.ErrorMessage);
+        }
+
+        [Fact]
+        public void Evaluate_ReturnsFailureIfProtocolVersionLowerThenRequiredAndClientVersionHigher()
+        {
+            // Arrange & Act
+            var result = Evaluate("4.1.0", actualClientVersion: "4.1.0", actualProtocolVersion: "2.5.0-beta1");
+
+            // Assert
+            Assert.False(result.Success);
+            Assert.NotNull(result.ErrorMessage);
+        }
+
+        [Fact]
+        public void Evaluate_ReturnsSuccessIfProtocolVersionHigherThenRequiredAndClientVersionLower()
+        {
+            // Arrange & Act
+            var result = Evaluate("4.1.0", actualClientVersion: "2.5.0-beta1", actualProtocolVersion: "4.1.0");
+
+            // Assert
+            Assert.True(result.Success);
+            Assert.Null(result.ErrorMessage);
+        }
+
+        [Fact]
+        public void Evaluate_ReturnsFailureIfProtocolVersionHeaderIsMissing()
+        {
+            // Arrange & Act
+            var result = Evaluate(minProtocolVersions: "4.1.0", actualClientVersion: string.Empty, actualProtocolVersion: string.Empty);
+
+            // Assert
+            Assert.False(result.Success);
+            Assert.NotNull(result.ErrorMessage);
+        }
+
+        private SecurityPolicyResult Evaluate(string minProtocolVersions, string actualClientVersion, string actualProtocolVersion)
+        {
+            var headers = new NameValueCollection();
+            if (!string.IsNullOrEmpty(actualClientVersion))
+            {
+                headers[Constants.ClientVersionHeaderName] = actualClientVersion;
+            }
+
+            if (!string.IsNullOrEmpty(actualProtocolVersion))
+            {
+                headers[Constants.NuGetProtocolHeaderName] = actualProtocolVersion;
+            }
+
+            var httpRequest = new Mock<HttpRequestBase>();
+            httpRequest.Setup(r => r.Headers).Returns(headers);
+
+            var httpContext = new Mock<HttpContextBase>();
+            httpContext.Setup(c => c.Request).Returns(httpRequest.Object);
+
+            var policies = minProtocolVersions.Split(',').Select(
+                v => RequireMinProtocolVersionForPushPolicy.CreatePolicy("Subscription", new NuGetVersion(v))
+            ).ToArray();
+            var context = new UserSecurityPolicyEvaluationContext(httpContext.Object, policies);
+
+            return new RequireMinProtocolVersionForPushPolicy().Evaluate(context);
+        }
+    }
+}
diff --git a/tests/NuGetGallery.Facts/Security/SecurePushSubscriptionFacts.cs b/tests/NuGetGallery.Facts/Security/SecurePushSubscriptionFacts.cs
index 9ea32796bd..381eff3655 100644
--- a/tests/NuGetGallery.Facts/Security/SecurePushSubscriptionFacts.cs
+++ b/tests/NuGetGallery.Facts/Security/SecurePushSubscriptionFacts.cs
@@ -34,7 +34,7 @@ public void Policies_ReturnsMinClientAndPackageVerifyScopePolicies()
         {
             // Arrange.
             var subscription = CreateSecurityPolicyService().UserSubscriptions.Single();
-            var policy1 = subscription.Policies.FirstOrDefault(p => p.Name.Equals(RequireMinClientVersionForPushPolicy.PolicyName));
+            var policy1 = subscription.Policies.FirstOrDefault(p => p.Name.Equals(RequireMinProtocolVersionForPushPolicy.PolicyName));
             var policy2 = subscription.Policies.FirstOrDefault(p => p.Name.Equals(RequirePackageVerifyScopePolicy.PolicyName));
 
             // Act & Assert.
diff --git a/tests/NuGetGallery.Facts/Security/SecurityPolicyServiceFacts.cs b/tests/NuGetGallery.Facts/Security/SecurityPolicyServiceFacts.cs
index 89bbcea3ac..66f3bda4a6 100644
--- a/tests/NuGetGallery.Facts/Security/SecurityPolicyServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Security/SecurityPolicyServiceFacts.cs
@@ -9,6 +9,7 @@
 using System.Web;
 using Moq;
 using NuGetGallery.Auditing;
+using NuGetGallery.Configuration;
 using NuGetGallery.Diagnostics;
 using NuGetGallery.Framework;
 using Xunit;
@@ -20,30 +21,32 @@ public class SecurityPolicyServiceFacts
         private static IEntitiesContext _entities = new Mock<IEntitiesContext>().Object;
         private static IAuditingService _auditing = new Mock<IAuditingService>().Object;
         private static IDiagnosticsService _diagnostics = new Mock<IDiagnosticsService>().Object;
+        private static IAppConfiguration _configuration = new Mock<IAppConfiguration>().Object;
 
         public static IEnumerable<object[]> CtorThrowNullReference_Data
         {
             get
             {
-                yield return new object[] { null, _auditing, _diagnostics};
-                yield return new object[] { _entities, null, _diagnostics };
-                yield return new object[] { _entities, _auditing, null };
+                yield return new object[] { null, _auditing, _diagnostics, _configuration};
+                yield return new object[] { _entities, null, _diagnostics, _configuration };
+                yield return new object[] { _entities, _auditing, null, _configuration };
+                yield return new object[] { _entities, _auditing, _diagnostics, null };
             }
         }
         
         [Theory]
         [MemberData(nameof(CtorThrowNullReference_Data))]
         public void Constructor_ThrowsArgumentNullIfArgumentMissing(
-            IEntitiesContext entities, IAuditingService auditing, IDiagnosticsService diagnostics)
+            IEntitiesContext entities, IAuditingService auditing, IDiagnosticsService diagnostics, IAppConfiguration configuration)
         {
-            Assert.Throws<ArgumentNullException>(() => new SecurityPolicyService(entities, auditing, diagnostics));
+            Assert.Throws<ArgumentNullException>(() => new SecurityPolicyService(entities, auditing, diagnostics, configuration));
         }
 
         [Fact]
         public void UserHandlers_ReturnsRegisteredUserSecurityPolicyHandlers()
         {
             // Arrange.
-            var service = new SecurityPolicyService(_entities, _auditing, _diagnostics);
+            var service = new SecurityPolicyService(_entities, _auditing, _diagnostics, _configuration);
 
             // Act.
             var handlers = ((IEnumerable<UserSecurityPolicyHandler>)service.GetType()
@@ -52,9 +55,10 @@ public void UserHandlers_ReturnsRegisteredUserSecurityPolicyHandlers()
 
             // Assert
             Assert.NotNull(handlers);
-            Assert.Equal(2, handlers.Count);
+            Assert.Equal(3, handlers.Count);
             Assert.Equal(typeof(RequireMinClientVersionForPushPolicy), handlers[0].GetType());
             Assert.Equal(typeof(RequirePackageVerifyScopePolicy), handlers[1].GetType());
+            Assert.Equal(typeof(RequireMinProtocolVersionForPushPolicy), handlers[2].GetType());
         }
 
         [Fact]
@@ -78,8 +82,8 @@ public async Task EvaluateAsync_ReturnsSuccessWithoutEvaluationIfNoPoliciesWereF
             Assert.True(result.Success);
             Assert.Null(result.ErrorMessage);
 
-            service.Mocks.MockPolicy1.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Never);
-            service.Mocks.MockPolicy2.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Never);
+            service.Mocks.MockPolicyHandler1.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Never);
+            service.Mocks.MockPolicyHandler2.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Never);
         }
 
         [Fact]
@@ -98,8 +102,8 @@ public async Task EvaluateAsync_ReturnsSuccessWithEvaluationIfPoliciesFoundAndMe
             Assert.True(result.Success);
             Assert.Null(result.ErrorMessage);
 
-            service.Mocks.MockPolicy1.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
-            service.Mocks.MockPolicy2.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
+            service.Mocks.MockPolicyHandler1.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
+            service.Mocks.MockPolicyHandler2.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
         }
 
         [Fact]
@@ -139,6 +143,110 @@ public async Task EvaluateAsync_SavesAuditRecordsForSuccessAndFailureCases(bool
             service.MockAuditingService.Verify(s => s.SaveAuditRecordAsync(It.IsAny<AuditRecord>()), Times.Exactly(times));
         }
 
+        [Fact]
+        public async Task EvaluateAsync_EvaluatesOnlyPoliciesRelevantToTheAction()
+        {
+            // Arrange
+            const string extraPolicyName = "ExtraPolicy";
+            var extraPolicyHandlerMock = new Mock<UserSecurityPolicyHandler>(extraPolicyName, SecurityPolicyAction.ManagePackageOwners);
+
+            var policyData = new TestUserSecurityPolicyData();
+            var policyHandlers = new List<UserSecurityPolicyHandler>(policyData.Handlers.Select(x => x.Object));
+            policyHandlers.Add(extraPolicyHandlerMock.Object);
+
+            var service = new TestSecurityPolicyService(policyData, policyHandlers);
+            var user = new User("testUser");
+            var subscription = service.Mocks.Subscription.Object;
+
+            var userSecurityPolicies = new List<UserSecurityPolicy>(subscription.Policies);
+            userSecurityPolicies.Add(new UserSecurityPolicy(extraPolicyName, "ExtraSubscription"));
+            user.SecurityPolicies = userSecurityPolicies;
+
+            // Act
+            var result = await service.EvaluateAsync(SecurityPolicyAction.PackagePush, CreateHttpContext(user));
+
+            // Assert
+            Assert.True(result.Success);
+            Assert.Null(result.ErrorMessage);
+
+            service.Mocks.MockPolicyHandler1.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
+            service.Mocks.MockPolicyHandler2.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
+            extraPolicyHandlerMock.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Never);
+        }
+
+        [Fact]
+        public async Task EvaluateAsync_WhenEnforceDefaultSecurityPoliciesIsFalseDefaultPolicyNotEvaluated()
+        {
+            // Arrange
+            var policyData = new TestUserSecurityPolicyData(policy1Result: true, policy2Result: true, defaultPolicy1Result: false, defaultPolicy2Result: false);
+            var service = new TestSecurityPolicyService(policyData);
+            var user = new User("testUser");
+            var subscription = service.Mocks.Subscription.Object;
+            user.SecurityPolicies = subscription.Policies.ToList();
+
+            // Act
+            var result = await service.EvaluateAsync(SecurityPolicyAction.PackagePush, CreateHttpContext(user));
+
+            // Assert
+            Assert.True(result.Success);
+            Assert.Null(result.ErrorMessage);
+
+            service.Mocks.MockPolicyHandler1.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
+            service.Mocks.MockPolicyHandler2.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
+        }
+
+        [Fact]
+        public async Task EvaluateAsync_WhenDefaultSecurityPolicyNotMetReturnFailure()
+        {
+            // Arrange
+            var policyData = new TestUserSecurityPolicyData(policy1Result: true, policy2Result: true, defaultPolicy1Result: true, defaultPolicy2Result: false);
+            var configuration = new AppConfiguration() { EnforceDefaultSecurityPolicies = true };
+            var service = new TestSecurityPolicyService(policyData, null, null, null, null, configuration);
+            var user = new User("testUser");
+            var subscription = service.Mocks.Subscription.Object;
+            user.SecurityPolicies = subscription.Policies.ToList();
+
+            // Act
+            var result = await service.EvaluateAsync(SecurityPolicyAction.PackagePush, CreateHttpContext(user));
+
+            // Assert
+            Assert.Equal(false, result.Success);
+            
+            // The error indicates which subscription failed
+            Assert.Contains(policyData.DefaultSubscription.Object.SubscriptionName, result.ErrorMessage);
+
+            // Audit record is saved
+            service.MockAuditingService.Verify(s => s.SaveAuditRecordAsync(It.IsAny<AuditRecord>()), Times.Once);
+
+            // Policies are evaluated only once
+            service.Mocks.MockPolicyHandler1.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
+            service.Mocks.MockPolicyHandler2.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
+        }
+
+        [Theory]
+        [InlineData(true)]
+        [InlineData(false)]
+        public async Task EvaluateAsync_WhenDefaultSecurityPolicyIsMetUserPolicyIsEvaluated(bool userPolicyMet)
+        {
+            // Arrange
+            var policyData = new TestUserSecurityPolicyData(policy1Result: true, policy2Result: userPolicyMet, defaultPolicy1Result: true, defaultPolicy2Result: true);
+            var configuration = new AppConfiguration() { EnforceDefaultSecurityPolicies = true };
+            var service = new TestSecurityPolicyService(policyData, null, null, null, null, configuration);
+            var user = new User("testUser");
+            var subscription = service.Mocks.Subscription.Object;
+            user.SecurityPolicies = subscription.Policies.ToList();
+
+            // Act
+            var result = await service.EvaluateAsync(SecurityPolicyAction.PackagePush, CreateHttpContext(user));
+
+            // Assert
+            Assert.Equal(userPolicyMet, result.Success);
+
+            // Default policies and user policies are evaluated
+            service.Mocks.MockPolicyHandler1.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Exactly(2));
+            service.Mocks.MockPolicyHandler2.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Exactly(2));
+        }
+
         [Theory]
         [InlineData("")]
         [InlineData(null)]
diff --git a/tests/NuGetGallery.Facts/Security/TestSecurityPolicyService.cs b/tests/NuGetGallery.Facts/Security/TestSecurityPolicyService.cs
index cec1194024..636af17bb3 100644
--- a/tests/NuGetGallery.Facts/Security/TestSecurityPolicyService.cs
+++ b/tests/NuGetGallery.Facts/Security/TestSecurityPolicyService.cs
@@ -7,8 +7,8 @@
 using System.Threading.Tasks;
 using Moq;
 using NuGetGallery.Auditing;
+using NuGetGallery.Configuration;
 using NuGetGallery.Diagnostics;
-using System.Diagnostics;
 
 namespace NuGetGallery.Security
 {
@@ -18,6 +18,8 @@ public class TestSecurityPolicyService : SecurityPolicyService
 
         public Mock<IEntitiesContext> MockEntitiesContext { get; }
 
+        public IAppConfiguration AppConfiguration { get; }
+
         public Mock<IDbSet<UserSecurityPolicy>> MockUserSecurityPolicies { get; }
         
         public TestUserSecurityPolicyData Mocks { get; }
@@ -31,18 +33,21 @@ public TestSecurityPolicyService(
             IEnumerable<UserSecurityPolicyHandler> userHandlers = null,
             IEnumerable<IUserSecurityPolicySubscription> userSubscriptions = null,
             Mock<IEntitiesContext> mockEntities = null,
-            Mock<IAuditingService> mockAuditing = null)
-            : this(mockEntities, mockAuditing)
+            Mock<IAuditingService> mockAuditing = null,
+            IAppConfiguration configuration = null)
+            : this(mockEntities, mockAuditing, configuration)
         {
             Mocks = mocks ?? new TestUserSecurityPolicyData();
 
             UserHandlers = userHandlers ?? Mocks.Handlers.Select(m => m.Object);
             UserSubscriptions = userSubscriptions ?? new [] { Mocks.Subscription.Object };
+            DefaultSubscription = Mocks.DefaultSubscription.Object;
         }
 
         protected TestSecurityPolicyService(
             Mock<IEntitiesContext> mockEntities,
-            Mock<IAuditingService> mockAuditing)
+            Mock<IAuditingService> mockAuditing,
+            IAppConfiguration configuration)
         {
             MockUserSecurityPolicies = new Mock<IDbSet<UserSecurityPolicy>>();
             MockUserSecurityPolicies.Setup(p => p.Remove(It.IsAny<UserSecurityPolicy>())).Verifiable();
@@ -63,6 +68,8 @@ protected TestSecurityPolicyService(
             }
             Auditing = MockAuditingService.Object;
 
+            Configuration = configuration ?? new AppConfiguration();
+
             Diagnostics = new DiagnosticsService().GetSource(nameof(TestSecurityPolicyService));
         }
     }
diff --git a/tests/NuGetGallery.Facts/Security/TestUserSecurityPolicyData.cs b/tests/NuGetGallery.Facts/Security/TestUserSecurityPolicyData.cs
index c9bebbd40b..5aafb80f94 100644
--- a/tests/NuGetGallery.Facts/Security/TestUserSecurityPolicyData.cs
+++ b/tests/NuGetGallery.Facts/Security/TestUserSecurityPolicyData.cs
@@ -5,7 +5,6 @@
 using System.Linq;
 using System.Threading.Tasks;
 using Moq;
-using NuGetGallery.Filters;
 using Xunit;
 
 namespace NuGetGallery.Security
@@ -13,11 +12,24 @@ namespace NuGetGallery.Security
     public class TestUserSecurityPolicyData
     {
         private const string MockSubscriptionName = "MockSubscription";
+        private const string MockDefaultSubscriptionName = "Default";
 
-        public TestUserSecurityPolicyData(bool policy1Result = true, bool policy2Result = true)
+        public TestUserSecurityPolicyData(bool policy1Result = true, bool policy2Result = true, bool defaultPolicy1Result = true, bool defaultPolicy2Result = true)
         {
-            MockPolicy1 = MockHandler(nameof(MockPolicy1), policy1Result);
-            MockPolicy2 = MockHandler(nameof(MockPolicy2), policy2Result);
+            var resultPerSubscription1 = new Dictionary<string, bool>()
+            {
+                { MockSubscriptionName, policy1Result },
+                { MockDefaultSubscriptionName, defaultPolicy1Result }
+            };
+
+            var resultPerSubscription2 = new Dictionary<string, bool>()
+            {
+                { MockSubscriptionName, policy2Result },
+                { MockDefaultSubscriptionName, defaultPolicy2Result }
+            };
+
+            MockPolicyHandler1 = MockHandler(nameof(MockPolicyHandler1), resultPerSubscription1);
+            MockPolicyHandler2 = MockHandler(nameof(MockPolicyHandler2), resultPerSubscription2);
 
             Subscription = new Mock<IUserSecurityPolicySubscription>();
             Subscription.Setup(s => s.SubscriptionName).Returns(MockSubscriptionName);
@@ -25,21 +37,27 @@ public TestUserSecurityPolicyData(bool policy1Result = true, bool policy2Result
                 .Returns(Task.CompletedTask).Verifiable();
             Subscription.Setup(s => s.OnUnsubscribeAsync(It.IsAny<UserSecurityPolicySubscriptionContext>()))
                 .Returns(Task.CompletedTask).Verifiable();
-            Subscription.Setup(s => s.Policies).Returns(GetMockPolicies());
+            Subscription.Setup(s => s.Policies).Returns(GetMockPolicies(MockSubscriptionName));
+            
+            DefaultSubscription = new Mock<IUserSecurityPolicySubscription>();
+            DefaultSubscription.Setup(s => s.SubscriptionName).Returns(MockDefaultSubscriptionName);
+            DefaultSubscription.Setup(s => s.Policies).Returns(GetMockPolicies(MockDefaultSubscriptionName));
         }
 
         public Mock<IUserSecurityPolicySubscription> Subscription { get; }
 
-        public Mock<UserSecurityPolicyHandler> MockPolicy1 { get; }
+        public Mock<IUserSecurityPolicySubscription> DefaultSubscription { get; }
+
+        public Mock<UserSecurityPolicyHandler> MockPolicyHandler1 { get; }
 
-        public Mock<UserSecurityPolicyHandler> MockPolicy2 { get; }
+        public Mock<UserSecurityPolicyHandler> MockPolicyHandler2 { get; }
 
         public IEnumerable<Mock<UserSecurityPolicyHandler>> Handlers
         {
             get
             {
-                yield return MockPolicy1;
-                yield return MockPolicy2;
+                yield return MockPolicyHandler1;
+                yield return MockPolicyHandler2;
             }
         }
 
@@ -64,26 +82,32 @@ public void VerifyPolicyEvaluation(bool expectedPolicy1, bool? expectedPolicy2,
             string failedPolicy = null;
             if (!expectedSuccess)
             {
-                failedPolicy = expectedPolicy1 ? nameof(MockPolicy2) : nameof(MockPolicy1);
+                failedPolicy = expectedPolicy1 ? nameof(MockPolicyHandler2) : nameof(MockPolicyHandler1);
             }
-            Assert.Equal(failedPolicy, actual.ErrorMessage);
+            Assert.Contains(failedPolicy, actual.ErrorMessage);
             
-            MockPolicy1.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
-            MockPolicy2.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()),
+            MockPolicyHandler1.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()), Times.Once);
+            MockPolicyHandler2.Verify(p => p.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()),
                 expectedPolicy2.HasValue ? Times.Once() : Times.Never());
         }
 
-        private static IEnumerable<UserSecurityPolicy> GetMockPolicies()
+        private static IEnumerable<UserSecurityPolicy> GetMockPolicies(string subscriptionName)
         {
-            yield return new UserSecurityPolicy(nameof(MockPolicy1), MockSubscriptionName);
-            yield return new UserSecurityPolicy(nameof(MockPolicy2), MockSubscriptionName);
+            yield return new UserSecurityPolicy(nameof(MockPolicyHandler1), subscriptionName);
+            yield return new UserSecurityPolicy(nameof(MockPolicyHandler2), subscriptionName);
         }
 
-        private Mock<UserSecurityPolicyHandler> MockHandler(string name, bool success)
+        private static Mock<UserSecurityPolicyHandler> MockHandler(string name, Dictionary<string, bool> resultPerSubscription)
         {
-            var result = success ? SecurityPolicyResult.SuccessResult : SecurityPolicyResult.CreateErrorResult(name);
             var mock = new Mock<UserSecurityPolicyHandler>(name, SecurityPolicyAction.PackagePush);
-            mock.Setup(m => m.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>())).Returns(result).Verifiable();
+            mock.Setup(m => m.Evaluate(It.IsAny<UserSecurityPolicyEvaluationContext>()))
+                .Returns<UserSecurityPolicyEvaluationContext>(x =>
+                {
+                    var subscription = x.Policies.First().Subscription;
+                    return resultPerSubscription[subscription] == true ? 
+                        SecurityPolicyResult.SuccessResult :
+                        SecurityPolicyResult.CreateErrorResult($"{subscription}-{name}");
+                }).Verifiable();
             return mock;
         }
     }

From ef14a42eb6fd5079e43ce38305b1ffcd5637bf5f Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Wed, 27 Sep 2017 17:04:16 -0700
Subject: [PATCH 17/25] Split some of PackageFileService and FileStorageService
 into NuGetGallery.Core (#4759)

Progress on https://github.com/NuGet/NuGetGallery/issues/4646
---
 src/NuGetGallery.Core/CoreConstants.cs        |  15 +
 src/NuGetGallery.Core/CoreStrings.Designer.cs |   9 +
 src/NuGetGallery.Core/CoreStrings.resx        |   3 +
 .../NuGetGallery.Core.csproj                  |  10 +
 .../CloudBlobCoreFileStorageService.cs        | 244 +++++++++
 .../Services/CloudFileReference.cs            |   0
 .../Services/CorePackageFileService.cs        |  83 +++
 .../Services/ICloudBlobClient.cs              |   0
 .../Services/ICloudBlobContainer.cs           |   0
 .../Services/ICoreFileStorageService.cs       |  28 +
 .../Services/ICorePackageFileService.cs       |  21 +
 .../Services/IFileReference.cs                |   0
 .../Services/ISimpleCloudBlob.cs              |   0
 .../TestableStorageClientException.cs         |   0
 src/NuGetGallery/Constants.cs                 |  12 -
 .../Controllers/PackagesController.cs         |   2 +-
 src/NuGetGallery/NuGetGallery.csproj          |  10 +-
 .../Services/CloudBlobFileStorageService.cs   | 237 +--------
 src/NuGetGallery/Services/ContentService.cs   |   2 +-
 .../Services/FileSystemFileStorageService.cs  |   8 +-
 .../Services/IFileStorageService.cs           |  21 +-
 .../Services/IPackageFileService.cs           |  13 +-
 .../Services/NuGetExeDownloaderService.cs     |   2 +-
 .../Services/PackageFileService.cs            |  90 +---
 .../Services/UploadFileService.cs             |   8 +-
 src/NuGetGallery/Strings.Designer.cs          |   9 -
 src/NuGetGallery/Strings.resx                 |   3 -
 src/NuGetGallery/WebApi/PlainTextResult.cs    |   2 +-
 .../NuGetGallery.Core.Facts.csproj            |   3 +
 .../CloudBlobCoreFileStorageServiceFacts.cs   | 491 ++++++++++++++++++
 .../Services/CorePackageFileServiceFacts.cs   | 168 ++++++
 .../TestUtils/CoreMockExtensions.cs           |  19 +
 .../NuGetGallery.Facts.csproj                 |   1 -
 .../CloudBlobFileStorageServiceFacts.cs       | 451 +---------------
 .../Services/ContentServiceFacts.cs           |  16 +-
 .../FileSystemFileStorageServiceFacts.cs      |  24 +-
 .../Services/PackageFileServiceFacts.cs       | 145 +-----
 .../Services/UploadFileServiceFacts.cs        |  16 +-
 .../TestUtils/MockExtensions.cs               |   6 -
 .../TestUtils/TaskAssert.cs                   |  29 --
 40 files changed, 1178 insertions(+), 1023 deletions(-)
 create mode 100644 src/NuGetGallery.Core/Services/CloudBlobCoreFileStorageService.cs
 rename src/{NuGetGallery => NuGetGallery.Core}/Services/CloudFileReference.cs (100%)
 create mode 100644 src/NuGetGallery.Core/Services/CorePackageFileService.cs
 rename src/{NuGetGallery => NuGetGallery.Core}/Services/ICloudBlobClient.cs (100%)
 rename src/{NuGetGallery => NuGetGallery.Core}/Services/ICloudBlobContainer.cs (100%)
 create mode 100644 src/NuGetGallery.Core/Services/ICoreFileStorageService.cs
 create mode 100644 src/NuGetGallery.Core/Services/ICorePackageFileService.cs
 rename src/{NuGetGallery => NuGetGallery.Core}/Services/IFileReference.cs (100%)
 rename src/{NuGetGallery => NuGetGallery.Core}/Services/ISimpleCloudBlob.cs (100%)
 rename src/{NuGetGallery => NuGetGallery.Core}/Services/TestableStorageClientException.cs (100%)
 create mode 100644 tests/NuGetGallery.Core.Facts/Services/CloudBlobCoreFileStorageServiceFacts.cs
 create mode 100644 tests/NuGetGallery.Core.Facts/Services/CorePackageFileServiceFacts.cs
 create mode 100644 tests/NuGetGallery.Core.Facts/TestUtils/CoreMockExtensions.cs
 delete mode 100644 tests/NuGetGallery.Facts/TestUtils/TaskAssert.cs

diff --git a/src/NuGetGallery.Core/CoreConstants.cs b/src/NuGetGallery.Core/CoreConstants.cs
index 354cf2b4c7..60e2798294 100644
--- a/src/NuGetGallery.Core/CoreConstants.cs
+++ b/src/NuGetGallery.Core/CoreConstants.cs
@@ -6,5 +6,20 @@ namespace NuGetGallery
     public static class CoreConstants
     {
         public const int MaxPackageIdLength = 128;
+
+        public const string PackageFileSavePathTemplate = "{0}.{1}{2}";
+
+        public const string NuGetPackageFileExtension = ".nupkg";
+
+        public const string PackageContentType = "binary/octet-stream";
+        public const string OctetStreamContentType = "application/octet-stream";
+        public const string TextContentType = "text/plain";
+
+        public const string ContentFolderName = "content";
+        public const string DownloadsFolderName = "downloads";
+        public const string PackageBackupsFolderName = "package-backups";
+        public const string PackageReadMesFolderName = "readmes";
+        public const string PackagesFolderName = "packages";        
+        public const string UploadsFolderName = "uploads";
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery.Core/CoreStrings.Designer.cs b/src/NuGetGallery.Core/CoreStrings.Designer.cs
index 4c15d4ddfe..8ea287255e 100644
--- a/src/NuGetGallery.Core/CoreStrings.Designer.cs
+++ b/src/NuGetGallery.Core/CoreStrings.Designer.cs
@@ -222,6 +222,15 @@ public static string NegativeIndexesAreInvalid {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to The package is missing required data..
+        /// </summary>
+        public static string PackageIsMissingRequiredData {
+            get {
+                return ResourceManager.GetString("PackageIsMissingRequiredData", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to The version string is invalid..
         /// </summary>
diff --git a/src/NuGetGallery.Core/CoreStrings.resx b/src/NuGetGallery.Core/CoreStrings.resx
index f4e5d8cb65..6161021022 100644
--- a/src/NuGetGallery.Core/CoreStrings.resx
+++ b/src/NuGetGallery.Core/CoreStrings.resx
@@ -186,4 +186,7 @@
   <data name="CookieComplianceServiceAlreadyInitialized" xml:space="preserve">
     <value>The cookie compliance service is already initialized.</value>
   </data>
+  <data name="PackageIsMissingRequiredData" xml:space="preserve">
+    <value>The package is missing required data.</value>
+  </data>
 </root>
\ No newline at end of file
diff --git a/src/NuGetGallery.Core/NuGetGallery.Core.csproj b/src/NuGetGallery.Core/NuGetGallery.Core.csproj
index 0b9692e620..2656fb4ac1 100644
--- a/src/NuGetGallery.Core/NuGetGallery.Core.csproj
+++ b/src/NuGetGallery.Core/NuGetGallery.Core.csproj
@@ -205,8 +205,18 @@
     <Compile Include="Properties\AssemblyInfo.*.cs" />
     <Compile Include="NuGetVersionExtensions.cs" />
     <Compile Include="SemVerLevelKey.cs" />
+    <Compile Include="Services\CloudBlobCoreFileStorageService.cs" />
+    <Compile Include="Services\CloudFileReference.cs" />
+    <Compile Include="Services\CorePackageFileService.cs" />
     <Compile Include="Services\CorePackageService.cs" />
+    <Compile Include="Services\ICloudBlobClient.cs" />
+    <Compile Include="Services\ICloudBlobContainer.cs" />
+    <Compile Include="Services\ICorePackageFileService.cs" />
     <Compile Include="Services\ICorePackageService.cs" />
+    <Compile Include="Services\IFileReference.cs" />
+    <Compile Include="Services\ICoreFileStorageService.cs" />
+    <Compile Include="Services\ISimpleCloudBlob.cs" />
+    <Compile Include="Services\TestableStorageClientException.cs" />
     <Compile Include="StreamExtensions.cs" />
     <Compile Include="CoreStrings.Designer.cs">
       <AutoGen>True</AutoGen>
diff --git a/src/NuGetGallery.Core/Services/CloudBlobCoreFileStorageService.cs b/src/NuGetGallery.Core/Services/CloudBlobCoreFileStorageService.cs
new file mode 100644
index 0000000000..cfb260f75c
--- /dev/null
+++ b/src/NuGetGallery.Core/Services/CloudBlobCoreFileStorageService.cs
@@ -0,0 +1,244 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Concurrent;
+using System.Globalization;
+using System.IO;
+using System.Net;
+using System.Threading.Tasks;
+using Microsoft.WindowsAzure.Storage;
+using Microsoft.WindowsAzure.Storage.Blob;
+using Microsoft.WindowsAzure.Storage.Blob.Protocol;
+
+namespace NuGetGallery
+{
+    public class CloudBlobCoreFileStorageService : ICoreFileStorageService
+    {
+        protected readonly ICloudBlobClient _client;
+        protected readonly ConcurrentDictionary<string, ICloudBlobContainer> _containers = new ConcurrentDictionary<string, ICloudBlobContainer>();
+
+        public CloudBlobCoreFileStorageService(ICloudBlobClient client)
+        {
+            _client = client;
+        }
+
+        public async Task DeleteFileAsync(string folderName, string fileName)
+        {
+            ICloudBlobContainer container = await GetContainer(folderName);
+            var blob = container.GetBlobReference(fileName);
+            await blob.DeleteIfExistsAsync();
+        }
+
+        public async Task<bool> FileExistsAsync(string folderName, string fileName)
+        {
+            ICloudBlobContainer container = await GetContainer(folderName);
+            var blob = container.GetBlobReference(fileName);
+            return await blob.ExistsAsync();
+        }
+
+        public async Task<Stream> GetFileAsync(string folderName, string fileName)
+        {
+            if (String.IsNullOrWhiteSpace(folderName))
+            {
+                throw new ArgumentNullException(nameof(folderName));
+            }
+
+            if (String.IsNullOrWhiteSpace(fileName))
+            {
+                throw new ArgumentNullException(nameof(fileName));
+            }
+
+            return (await GetBlobContentAsync(folderName, fileName)).Data;
+        }
+
+        public async Task<IFileReference> GetFileReferenceAsync(string folderName, string fileName, string ifNoneMatch = null)
+        {
+            if (String.IsNullOrWhiteSpace(folderName))
+            {
+                throw new ArgumentNullException(nameof(folderName));
+            }
+
+            if (String.IsNullOrWhiteSpace(fileName))
+            {
+                throw new ArgumentNullException(nameof(fileName));
+            }
+
+            ICloudBlobContainer container = await GetContainer(folderName);
+            var blob = container.GetBlobReference(fileName);
+            var result = await GetBlobContentAsync(folderName, fileName, ifNoneMatch);
+            if (result.StatusCode == HttpStatusCode.NotModified)
+            {
+                return CloudFileReference.NotModified(ifNoneMatch);
+            }
+            else if (result.StatusCode == HttpStatusCode.OK)
+            {
+                if (await blob.ExistsAsync())
+                {
+                    await blob.FetchAttributesAsync();
+                }
+                return CloudFileReference.Modified(blob, result.Data);
+            }
+            else
+            {
+                // Not found
+                return null;
+            }
+        }
+
+        public async Task SaveFileAsync(string folderName, string fileName, Stream packageFile, bool overwrite = true)
+        {
+            ICloudBlobContainer container = await GetContainer(folderName);
+            var blob = container.GetBlobReference(fileName);
+
+            try
+            {
+                await blob.UploadFromStreamAsync(packageFile, overwrite);
+            }
+            catch (StorageException ex) when (ex.RequestInformation?.HttpStatusCode == (int?)HttpStatusCode.Conflict)
+            {
+                throw new InvalidOperationException(
+                    String.Format(
+                        CultureInfo.CurrentCulture,
+                        "There is already a blob with name {0} in container {1}.",
+                        fileName,
+                        folderName),
+                    ex);
+            }
+
+            blob.Properties.ContentType = GetContentType(folderName);
+            await blob.SetPropertiesAsync();
+        }
+
+        protected async Task<ICloudBlobContainer> GetContainer(string folderName)
+        {
+            ICloudBlobContainer container;
+            if (_containers.TryGetValue(folderName, out container))
+            {
+                return container;
+            }
+
+            Task<ICloudBlobContainer> creationTask;
+            switch (folderName)
+            {
+                case CoreConstants.PackagesFolderName:
+                case CoreConstants.PackageBackupsFolderName:
+                case CoreConstants.DownloadsFolderName:
+                    creationTask = PrepareContainer(folderName, isPublic: true);
+                    break;
+
+                case CoreConstants.ContentFolderName:
+                case CoreConstants.UploadsFolderName:
+                case CoreConstants.PackageReadMesFolderName:
+                    creationTask = PrepareContainer(folderName, isPublic: false);
+                    break;
+
+                default:
+                    throw new InvalidOperationException(
+                        String.Format(CultureInfo.CurrentCulture, "The folder name {0} is not supported.", folderName));
+            }
+
+            container = await creationTask;
+            _containers[folderName] = container;
+            return container;
+        }
+
+        private async Task<StorageResult> GetBlobContentAsync(string folderName, string fileName, string ifNoneMatch = null)
+        {
+            ICloudBlobContainer container = await GetContainer(folderName);
+
+            var blob = container.GetBlobReference(fileName);
+
+            var stream = new MemoryStream();
+            try
+            {
+                await blob.DownloadToStreamAsync(
+                    stream, 
+                    accessCondition: 
+                        ifNoneMatch == null ? 
+                        null : 
+                        AccessCondition.GenerateIfNoneMatchCondition(ifNoneMatch));
+            }
+            catch (StorageException ex)
+            {
+                stream.Dispose();
+
+                if (ex.RequestInformation.HttpStatusCode == (int)HttpStatusCode.NotModified)
+                {
+                    return new StorageResult(HttpStatusCode.NotModified, null);
+                }
+                else if (ex.RequestInformation.ExtendedErrorInformation.ErrorCode == BlobErrorCodeStrings.BlobNotFound)
+                {
+                    return new StorageResult(HttpStatusCode.NotFound, null);
+                }
+
+                throw;
+            }
+            catch (TestableStorageClientException ex)
+            {
+                // This is for unit test only, because we can't construct an 
+                // StorageException object with the required ErrorCode
+                stream.Dispose();
+
+                if (ex.ErrorCode == BlobErrorCodeStrings.BlobNotFound)
+                {
+                    return new StorageResult(HttpStatusCode.NotFound, null);
+                }
+
+                throw;
+            }
+
+            stream.Position = 0;
+            return new StorageResult(HttpStatusCode.OK, stream);
+        }
+
+        private static string GetContentType(string folderName)
+        {
+            switch (folderName)
+            {
+                case CoreConstants.PackagesFolderName:
+                case CoreConstants.PackageBackupsFolderName:
+                case CoreConstants.UploadsFolderName:
+                    return CoreConstants.PackageContentType;
+
+                case CoreConstants.DownloadsFolderName:
+                    return CoreConstants.OctetStreamContentType;
+
+                case CoreConstants.PackageReadMesFolderName:
+                    return CoreConstants.TextContentType;
+
+                default:
+                    throw new InvalidOperationException(
+                        String.Format(CultureInfo.CurrentCulture, "The folder name {0} is not supported.", folderName));
+            }
+        }
+
+        private async Task<ICloudBlobContainer> PrepareContainer(string folderName, bool isPublic)
+        {
+            var container = _client.GetContainerReference(folderName);
+            await container.CreateIfNotExistAsync();
+            await container.SetPermissionsAsync(
+                new BlobContainerPermissions
+                {
+                    PublicAccess = isPublic ? BlobContainerPublicAccessType.Blob : BlobContainerPublicAccessType.Off
+                });
+
+            return container;
+        }
+
+        private struct StorageResult
+        {
+            private HttpStatusCode _statusCode;
+            private Stream _data;
+
+            public HttpStatusCode StatusCode { get { return _statusCode; } }
+            public Stream Data { get { return _data; } }
+
+            public StorageResult(HttpStatusCode statusCode, Stream data)
+            {
+                _statusCode = statusCode;
+                _data = data;
+            }
+        }
+    }
+}
diff --git a/src/NuGetGallery/Services/CloudFileReference.cs b/src/NuGetGallery.Core/Services/CloudFileReference.cs
similarity index 100%
rename from src/NuGetGallery/Services/CloudFileReference.cs
rename to src/NuGetGallery.Core/Services/CloudFileReference.cs
diff --git a/src/NuGetGallery.Core/Services/CorePackageFileService.cs b/src/NuGetGallery.Core/Services/CorePackageFileService.cs
new file mode 100644
index 0000000000..a909b71277
--- /dev/null
+++ b/src/NuGetGallery.Core/Services/CorePackageFileService.cs
@@ -0,0 +1,83 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Globalization;
+using System.IO;
+using System.Threading.Tasks;
+
+namespace NuGetGallery
+{
+    public class CorePackageFileService : ICorePackageFileService
+    {
+        private readonly ICoreFileStorageService _fileStorageService;
+
+        public CorePackageFileService(ICoreFileStorageService fileStorageService)
+        {
+            _fileStorageService = fileStorageService;
+        }
+
+        public Task SavePackageFileAsync(Package package, Stream packageFile)
+        {
+            if (packageFile == null)
+            {
+                throw new ArgumentNullException(nameof(packageFile));
+            }
+
+            var fileName = BuildFileName(package, CoreConstants.PackageFileSavePathTemplate, CoreConstants.NuGetPackageFileExtension);
+            return _fileStorageService.SaveFileAsync(CoreConstants.PackagesFolderName, fileName, packageFile, overwrite: false);
+        }
+
+        public Task<Stream> DownloadPackageFileAsync(Package package)
+        {
+            var fileName = BuildFileName(package, CoreConstants.PackageFileSavePathTemplate, CoreConstants.NuGetPackageFileExtension);
+            return _fileStorageService.GetFileAsync(CoreConstants.PackagesFolderName, fileName);
+        }
+
+        protected static string BuildFileName(Package package, string format, string extension)
+        {
+            if (package == null)
+            {
+                throw new ArgumentNullException(nameof(package));
+            }
+
+            if (package.PackageRegistration == null ||
+                String.IsNullOrWhiteSpace(package.PackageRegistration.Id) ||
+                (String.IsNullOrWhiteSpace(package.NormalizedVersion) && String.IsNullOrWhiteSpace(package.Version)))
+            {
+                throw new ArgumentException(CoreStrings.PackageIsMissingRequiredData, nameof(package));
+            }
+
+            return BuildFileName(
+                package.PackageRegistration.Id,
+                string.IsNullOrEmpty(package.NormalizedVersion) ?
+                    NuGetVersionFormatter.Normalize(package.Version) :
+                    package.NormalizedVersion, format, extension);
+        }
+
+        protected static string BuildFileName(string id, string version, string pathTemplate, string extension)
+        {
+            if (id == null)
+            {
+                throw new ArgumentNullException(nameof(id));
+            }
+
+            if (version == null)
+            {
+                throw new ArgumentNullException(nameof(version));
+            }
+
+            // Note: packages should be saved and retrieved in blob storage using the lower case version of their filename because
+            // a) package IDs can and did change case over time
+            // b) blob storage is case sensitive
+            // c) we don't want to hit the database just to look up the right case
+            // and remember - version can contain letters too.
+            return String.Format(
+                CultureInfo.InvariantCulture,
+                pathTemplate,
+                id.ToLowerInvariant(),
+                version.ToLowerInvariant(),
+                extension);
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/ICloudBlobClient.cs b/src/NuGetGallery.Core/Services/ICloudBlobClient.cs
similarity index 100%
rename from src/NuGetGallery/Services/ICloudBlobClient.cs
rename to src/NuGetGallery.Core/Services/ICloudBlobClient.cs
diff --git a/src/NuGetGallery/Services/ICloudBlobContainer.cs b/src/NuGetGallery.Core/Services/ICloudBlobContainer.cs
similarity index 100%
rename from src/NuGetGallery/Services/ICloudBlobContainer.cs
rename to src/NuGetGallery.Core/Services/ICloudBlobContainer.cs
diff --git a/src/NuGetGallery.Core/Services/ICoreFileStorageService.cs b/src/NuGetGallery.Core/Services/ICoreFileStorageService.cs
new file mode 100644
index 0000000000..0d7feadd57
--- /dev/null
+++ b/src/NuGetGallery.Core/Services/ICoreFileStorageService.cs
@@ -0,0 +1,28 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.IO;
+using System.Threading.Tasks;
+
+namespace NuGetGallery
+{
+    public interface ICoreFileStorageService
+    {
+        Task DeleteFileAsync(string folderName, string fileName);
+
+        Task<bool> FileExistsAsync(string folderName, string fileName);
+
+        Task<Stream> GetFileAsync(string folderName, string fileName);
+
+        /// <summary>
+        /// Gets a reference to a file in the storage service, which can be used to open the full file data.
+        /// </summary>
+        /// <param name="folderName">The folder containing the file to open</param>
+        /// <param name="fileName">The file within that folder to open</param>
+        /// <param name="ifNoneMatch">The <see cref="IFileReference.ContentId"/> value to use in an If-None-Match request</param>
+        /// <returns>A <see cref="IFileReference"/> representing the file reference</returns>
+        Task<IFileReference> GetFileReferenceAsync(string folderName, string fileName, string ifNoneMatch = null);
+
+        Task SaveFileAsync(string folderName, string fileName, Stream packageFile, bool overwrite = true);
+    }
+}
diff --git a/src/NuGetGallery.Core/Services/ICorePackageFileService.cs b/src/NuGetGallery.Core/Services/ICorePackageFileService.cs
new file mode 100644
index 0000000000..e0de04bb0c
--- /dev/null
+++ b/src/NuGetGallery.Core/Services/ICorePackageFileService.cs
@@ -0,0 +1,21 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.IO;
+using System.Threading.Tasks;
+
+namespace NuGetGallery
+{
+    public interface ICorePackageFileService
+    {
+        /// <summary>
+        /// Saves the contents of the package to the public container for available packages.
+        /// </summary>
+        Task SavePackageFileAsync(Package package, Stream packageFile);
+
+        /// <summary>
+        /// Downloads the package from the file storage and reads it into a stream.
+        /// </summary>
+        Task<Stream> DownloadPackageFileAsync(Package package);
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/IFileReference.cs b/src/NuGetGallery.Core/Services/IFileReference.cs
similarity index 100%
rename from src/NuGetGallery/Services/IFileReference.cs
rename to src/NuGetGallery.Core/Services/IFileReference.cs
diff --git a/src/NuGetGallery/Services/ISimpleCloudBlob.cs b/src/NuGetGallery.Core/Services/ISimpleCloudBlob.cs
similarity index 100%
rename from src/NuGetGallery/Services/ISimpleCloudBlob.cs
rename to src/NuGetGallery.Core/Services/ISimpleCloudBlob.cs
diff --git a/src/NuGetGallery/Services/TestableStorageClientException.cs b/src/NuGetGallery.Core/Services/TestableStorageClientException.cs
similarity index 100%
rename from src/NuGetGallery/Services/TestableStorageClientException.cs
rename to src/NuGetGallery.Core/Services/TestableStorageClientException.cs
diff --git a/src/NuGetGallery/Constants.cs b/src/NuGetGallery/Constants.cs
index 0dc75f7a10..cf15111eda 100644
--- a/src/NuGetGallery/Constants.cs
+++ b/src/NuGetGallery/Constants.cs
@@ -33,24 +33,13 @@ public static class Constants
 
         public const int MaxEmailSubjectLength = 255;
         internal static readonly NuGetVersion MaxSupportedMinClientVersion = new NuGetVersion("4.1.0.0");
-        public const string PackageContentType = "binary/octet-stream";
-        public const string OctetStreamContentType = "application/octet-stream";
-        public const string TextContentType = "text/plain";
         public const string PackageFileDownloadUriTemplate = "packages/{0}/{1}/download";
-        public const string PackageFileSavePathTemplate = "{0}.{1}{2}";
 
         public const string ReadMeFileSavePathTemplateActive = "active/{0}/{1}{2}";
         public const string ReadMeFileSavePathTemplatePending = "pending/{0}/{1}{2}";
 
         public const string PackageFileBackupSavePathTemplate = "{0}/{1}/{2}.{3}";
 
-        public const string PackagesFolderName = "packages";
-        public const string PackageBackupsFolderName = "package-backups";
-        public const string DownloadsFolderName = "downloads";
-        public const string ContentFolderName = "content";
-        public const string PackageReadMesFolderName = "readmes";
-
-        public const string NuGetPackageFileExtension = ".nupkg";
         public const string MarkdownFileExtension = ".md";
         public const string HtmlFileExtension = ".html";
         public const string JsonFileExtension = ".json";
@@ -64,7 +53,6 @@ public static class Constants
         public const string PBKDF2HashAlgorithmId = "PBKDF2";
 
         public const string UploadFileNameTemplate = "{0}{1}";
-        public const string UploadsFolderName = "uploads";
         public const string NuGetCommandLinePackageId = "NuGet.CommandLine";
 
         public static readonly string ReturnUrlViewDataKey = "ReturnUrl";
diff --git a/src/NuGetGallery/Controllers/PackagesController.cs b/src/NuGetGallery/Controllers/PackagesController.cs
index bf95b85f2b..34c351bb1c 100644
--- a/src/NuGetGallery/Controllers/PackagesController.cs
+++ b/src/NuGetGallery/Controllers/PackagesController.cs
@@ -248,7 +248,7 @@ public virtual async Task<JsonResult> UploadPackage(HttpPostedFileBase uploadFil
                 return Json(400, new[] { Strings.UploadFileIsRequired });
             }
 
-            if (!Path.GetExtension(uploadFile.FileName).Equals(Constants.NuGetPackageFileExtension, StringComparison.OrdinalIgnoreCase))
+            if (!Path.GetExtension(uploadFile.FileName).Equals(CoreConstants.NuGetPackageFileExtension, StringComparison.OrdinalIgnoreCase))
             {
                 ModelState.AddModelError(String.Empty, Strings.UploadFileMustBeNuGetPackage);
                 return Json(400, new[] { Strings.UploadFileMustBeNuGetPackage });
diff --git a/src/NuGetGallery/NuGetGallery.csproj b/src/NuGetGallery/NuGetGallery.csproj
index 174afb6126..182a681a8c 100644
--- a/src/NuGetGallery/NuGetGallery.csproj
+++ b/src/NuGetGallery/NuGetGallery.csproj
@@ -770,6 +770,8 @@
     <Compile Include="Helpers\GravatarHelper.cs" />
     <Compile Include="Helpers\RegexEx.cs" />
     <Compile Include="Services\AsynchronousPackageValidationInitiator.cs" />
+    <Compile Include="Services\CloudBlobFileStorageService.cs" />
+    <Compile Include="Services\IFileStorageService.cs" />
     <Compile Include="Services\ImmediatePackageValidator.cs" />
     <Compile Include="Services\IPackageValidationInitiator.cs" />
     <Compile Include="Infrastructure\HttpStatusCodeWithServerWarningResult.cs" />
@@ -1675,11 +1677,9 @@
     <Compile Include="Services\CuratedFeedService.cs" />
     <Compile Include="Services\DownloadCountObjectMaterializedInterceptor.cs" />
     <Compile Include="Services\ICuratedFeedService.cs" />
-    <Compile Include="Services\CloudFileReference.cs" />
     <Compile Include="Services\ContentService.cs" />
     <Compile Include="Services\IContentService.cs" />
     <Compile Include="Services\IDownloadCountService.cs" />
-    <Compile Include="Services\IFileReference.cs" />
     <Compile Include="Services\IPackageDeleteService.cs" />
     <Compile Include="Services\IRawSearchService.cs" />
     <Compile Include="Services\IStatusService.cs" />
@@ -1691,13 +1691,8 @@
     <Compile Include="Services\IStatisticsService.cs" />
     <Compile Include="Services\CloudBlobClientWrapper.cs" />
     <Compile Include="Services\CloudBlobContainerWrapper.cs" />
-    <Compile Include="Services\CloudBlobFileStorageService.cs" />
     <Compile Include="Services\CloudBlobWrapper.cs" />
     <Compile Include="Services\FileSystemFileStorageService.cs" />
-    <Compile Include="Services\ISimpleCloudBlob.cs" />
-    <Compile Include="Services\ICloudBlobClient.cs" />
-    <Compile Include="Services\ICloudBlobContainer.cs" />
-    <Compile Include="Services\IFileStorageService.cs" />
     <Compile Include="Services\IIndexingService.cs" />
     <Compile Include="Services\INuGetExeDownloaderService.cs" />
     <Compile Include="Services\IAggregateStatsService.cs" />
@@ -1721,7 +1716,6 @@
     <Compile Include="Services\StatisticsReportNotFoundException.cs" />
     <Compile Include="Services\StatisticsReportResult.cs" />
     <Compile Include="Services\StatusService.cs" />
-    <Compile Include="Services\TestableStorageClientException.cs" />
     <Compile Include="Services\UploadFileService.cs" />
     <Compile Include="Services\EditPackageService.cs" />
     <Compile Include="ViewModels\AggregateStats.cs" />
diff --git a/src/NuGetGallery/Services/CloudBlobFileStorageService.cs b/src/NuGetGallery/Services/CloudBlobFileStorageService.cs
index 785e30cf1e..ea5d59e7b4 100644
--- a/src/NuGetGallery/Services/CloudBlobFileStorageService.cs
+++ b/src/NuGetGallery/Services/CloudBlobFileStorageService.cs
@@ -2,31 +2,22 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
-using System.Collections.Concurrent;
 using System.Diagnostics;
-using System.Globalization;
-using System.IO;
-using System.Net;
 using System.Threading.Tasks;
 using System.Web;
 using System.Web.Mvc;
-using Microsoft.WindowsAzure.Storage;
-using Microsoft.WindowsAzure.Storage.Blob;
-using Microsoft.WindowsAzure.Storage.Blob.Protocol;
 using NuGetGallery.Configuration;
 
 namespace NuGetGallery
 {
-    public class CloudBlobFileStorageService : IFileStorageService, ICloudStorageStatusDependency
+    public class CloudBlobFileStorageService : CloudBlobCoreFileStorageService, IFileStorageService, ICloudStorageStatusDependency
     {
-        private readonly ICloudBlobClient _client;
         private readonly IAppConfiguration _configuration;
-        private readonly ConcurrentDictionary<string, ICloudBlobContainer> _containers = new ConcurrentDictionary<string, ICloudBlobContainer>();
         private readonly ISourceDestinationRedirectPolicy _redirectPolicy;
 
         public CloudBlobFileStorageService(ICloudBlobClient client, IAppConfiguration configuration, ISourceDestinationRedirectPolicy redirectPolicy)
+            : base(client)
         {
-            _client = client;
             _configuration = configuration;
             _redirectPolicy = redirectPolicy;
         }
@@ -40,215 +31,6 @@ public async Task<ActionResult> CreateDownloadFileActionResultAsync(Uri requestU
             return new RedirectResult(redirectUri.AbsoluteUri, false);
         }
 
-        public async Task DeleteFileAsync(string folderName, string fileName)
-        {
-            ICloudBlobContainer container = await GetContainer(folderName);
-            var blob = container.GetBlobReference(fileName);
-            await blob.DeleteIfExistsAsync();
-        }
-
-        public async Task<bool> FileExistsAsync(string folderName, string fileName)
-        {
-            ICloudBlobContainer container = await GetContainer(folderName);
-            var blob = container.GetBlobReference(fileName);
-            return await blob.ExistsAsync();
-        }
-
-        public async Task<Stream> GetFileAsync(string folderName, string fileName)
-        {
-            if (String.IsNullOrWhiteSpace(folderName))
-            {
-                throw new ArgumentNullException(nameof(folderName));
-            }
-
-            if (String.IsNullOrWhiteSpace(fileName))
-            {
-                throw new ArgumentNullException(nameof(fileName));
-            }
-
-            return (await GetBlobContentAsync(folderName, fileName)).Data;
-        }
-
-        public async Task<IFileReference> GetFileReferenceAsync(string folderName, string fileName, string ifNoneMatch = null)
-        {
-            if (String.IsNullOrWhiteSpace(folderName))
-            {
-                throw new ArgumentNullException(nameof(folderName));
-            }
-
-            if (String.IsNullOrWhiteSpace(fileName))
-            {
-                throw new ArgumentNullException(nameof(fileName));
-            }
-
-            ICloudBlobContainer container = await GetContainer(folderName);
-            var blob = container.GetBlobReference(fileName);
-            var result = await GetBlobContentAsync(folderName, fileName, ifNoneMatch);
-            if (result.StatusCode == HttpStatusCode.NotModified)
-            {
-                return CloudFileReference.NotModified(ifNoneMatch);
-            }
-            else if (result.StatusCode == HttpStatusCode.OK)
-            {
-                if (await blob.ExistsAsync())
-                {
-                    await blob.FetchAttributesAsync();
-                }
-                return CloudFileReference.Modified(blob, result.Data);
-            }
-            else
-            {
-                // Not found
-                return null;
-            }
-        }
-
-        public async Task SaveFileAsync(string folderName, string fileName, Stream packageFile, bool overwrite = true)
-        {
-            ICloudBlobContainer container = await GetContainer(folderName);
-            var blob = container.GetBlobReference(fileName);
-
-            try
-            {
-                await blob.UploadFromStreamAsync(packageFile, overwrite);
-            }
-            catch (StorageException ex) when (ex.RequestInformation?.HttpStatusCode == (int?)HttpStatusCode.Conflict)
-            {
-                throw new InvalidOperationException(
-                    String.Format(
-                        CultureInfo.CurrentCulture,
-                        "There is already a blob with name {0} in container {1}.",
-                        fileName,
-                        folderName),
-                    ex);
-            }
-
-            blob.Properties.ContentType = GetContentType(folderName);
-            await blob.SetPropertiesAsync();
-        }
-
-        public async Task<bool> IsAvailableAsync()
-        {
-            var container = await GetContainer(Constants.PackagesFolderName);
-            return await container.ExistsAsync();
-        }
-
-        private async Task<ICloudBlobContainer> GetContainer(string folderName)
-        {
-            ICloudBlobContainer container;
-            if (_containers.TryGetValue(folderName, out container))
-            {
-                return container;
-            }
-
-            Task<ICloudBlobContainer> creationTask;
-            switch (folderName)
-            {
-                case Constants.PackagesFolderName:
-                case Constants.PackageBackupsFolderName:
-                case Constants.DownloadsFolderName:
-                    creationTask = PrepareContainer(folderName, isPublic: true);
-                    break;
-
-                case Constants.ContentFolderName:
-                case Constants.UploadsFolderName:
-                case Constants.PackageReadMesFolderName:
-                    creationTask = PrepareContainer(folderName, isPublic: false);
-                    break;
-
-                default:
-                    throw new InvalidOperationException(
-                        String.Format(CultureInfo.CurrentCulture, "The folder name {0} is not supported.", folderName));
-            }
-
-            container = await creationTask;
-            _containers[folderName] = container;
-            return container;
-        }
-
-        private async Task<StorageResult> GetBlobContentAsync(string folderName, string fileName, string ifNoneMatch = null)
-        {
-            ICloudBlobContainer container = await GetContainer(folderName);
-
-            var blob = container.GetBlobReference(fileName);
-
-            var stream = new MemoryStream();
-            try
-            {
-                await blob.DownloadToStreamAsync(
-                    stream, 
-                    accessCondition: 
-                        ifNoneMatch == null ? 
-                        null : 
-                        AccessCondition.GenerateIfNoneMatchCondition(ifNoneMatch));
-            }
-            catch (StorageException ex)
-            {
-                stream.Dispose();
-
-                if (ex.RequestInformation.HttpStatusCode == (int)HttpStatusCode.NotModified)
-                {
-                    return new StorageResult(HttpStatusCode.NotModified, null);
-                }
-                else if (ex.RequestInformation.ExtendedErrorInformation.ErrorCode == BlobErrorCodeStrings.BlobNotFound)
-                {
-                    return new StorageResult(HttpStatusCode.NotFound, null);
-                }
-
-                throw;
-            }
-            catch (TestableStorageClientException ex)
-            {
-                // This is for unit test only, because we can't construct an 
-                // StorageException object with the required ErrorCode
-                stream.Dispose();
-
-                if (ex.ErrorCode == BlobErrorCodeStrings.BlobNotFound)
-                {
-                    return new StorageResult(HttpStatusCode.NotFound, null);
-                }
-
-                throw;
-            }
-
-            stream.Position = 0;
-            return new StorageResult(HttpStatusCode.OK, stream);
-        }
-
-        private static string GetContentType(string folderName)
-        {
-            switch (folderName)
-            {
-                case Constants.PackagesFolderName:
-                case Constants.PackageBackupsFolderName:
-                case Constants.UploadsFolderName:
-                    return Constants.PackageContentType;
-
-                case Constants.DownloadsFolderName:
-                    return Constants.OctetStreamContentType;
-
-                case Constants.PackageReadMesFolderName:
-                    return Constants.TextContentType;
-
-                default:
-                    throw new InvalidOperationException(
-                        String.Format(CultureInfo.CurrentCulture, "The folder name {0} is not supported.", folderName));
-            }
-        }
-
-        private async Task<ICloudBlobContainer> PrepareContainer(string folderName, bool isPublic)
-        {
-            var container = _client.GetContainerReference(folderName);
-            await container.CreateIfNotExistAsync();
-            await container.SetPermissionsAsync(
-                new BlobContainerPermissions
-                {
-                    PublicAccess = isPublic ? BlobContainerPublicAccessType.Blob : BlobContainerPublicAccessType.Off
-                });
-
-            return container;
-        }
-
         internal async Task<ActionResult> CreateDownloadFileActionResult(
             HttpContextBase httpContext,
             string folderName,
@@ -309,19 +91,10 @@ internal Uri GetRedirectUri(Uri requestUrl, Uri blobUri)
             return urlBuilder.Uri;
         }
 
-        private struct StorageResult
+        public async Task<bool> IsAvailableAsync()
         {
-            private HttpStatusCode _statusCode;
-            private Stream _data;
-
-            public HttpStatusCode StatusCode { get { return _statusCode; } }
-            public Stream Data { get { return _data; } }
-
-            public StorageResult(HttpStatusCode statusCode, Stream data)
-            {
-                _statusCode = statusCode;
-                _data = data;
-            }
+            var container = await GetContainer(CoreConstants.PackagesFolderName);
+            return await container.ExistsAsync();
         }
     }
 }
diff --git a/src/NuGetGallery/Services/ContentService.cs b/src/NuGetGallery/Services/ContentService.cs
index c80e00717b..009370dbef 100644
--- a/src/NuGetGallery/Services/ContentService.cs
+++ b/src/NuGetGallery/Services/ContentService.cs
@@ -124,7 +124,7 @@ private async Task<ContentItem> RefreshContentFromFile(string fileName, ContentI
             using (Trace.Activity("Downloading Content Item: " + fileName))
             {
                 IFileReference reference = await FileStorage.GetFileReferenceAsync(
-                    Constants.ContentFolderName,
+                    CoreConstants.ContentFolderName,
                     fileName,
                     ifNoneMatch: cachedItem?.ContentId);
 
diff --git a/src/NuGetGallery/Services/FileSystemFileStorageService.cs b/src/NuGetGallery/Services/FileSystemFileStorageService.cs
index 448a53194d..7ce0c7b3bf 100644
--- a/src/NuGetGallery/Services/FileSystemFileStorageService.cs
+++ b/src/NuGetGallery/Services/FileSystemFileStorageService.cs
@@ -194,11 +194,11 @@ private static string GetContentType(string folderName)
         {
             switch (folderName)
             {
-                case Constants.PackagesFolderName:
-                    return Constants.PackageContentType;
+                case CoreConstants.PackagesFolderName:
+                    return CoreConstants.PackageContentType;
 
-                case Constants.DownloadsFolderName:
-                    return Constants.OctetStreamContentType;
+                case CoreConstants.DownloadsFolderName:
+                    return CoreConstants.OctetStreamContentType;
 
                 default:
                     throw new InvalidOperationException(
diff --git a/src/NuGetGallery/Services/IFileStorageService.cs b/src/NuGetGallery/Services/IFileStorageService.cs
index 1733d2a48e..76b3cdbf5e 100644
--- a/src/NuGetGallery/Services/IFileStorageService.cs
+++ b/src/NuGetGallery/Services/IFileStorageService.cs
@@ -1,33 +1,16 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
 using System;
-using System.IO;
 using System.Threading.Tasks;
 using System.Web.Mvc;
 
 namespace NuGetGallery
 {
-    public interface IFileStorageService
+    public interface IFileStorageService : ICoreFileStorageService
     {
         Task<ActionResult> CreateDownloadFileActionResultAsync(Uri requestUrl, string folderName, string fileName);
 
-        Task DeleteFileAsync(string folderName, string fileName);
-
-        Task<bool> FileExistsAsync(string folderName, string fileName);
-
-        Task<Stream> GetFileAsync(string folderName, string fileName);
-
-        /// <summary>
-        /// Gets a reference to a file in the storage service, which can be used to open the full file data.
-        /// </summary>
-        /// <param name="folderName">The folder containing the file to open</param>
-        /// <param name="fileName">The file within that folder to open</param>
-        /// <param name="ifNoneMatch">The <see cref="IFileReference.ContentId"/> value to use in an If-None-Match request</param>
-        /// <returns>A <see cref="IFileReference"/> representing the file reference</returns>
-        Task<IFileReference> GetFileReferenceAsync(string folderName, string fileName, string ifNoneMatch = null);
-
-        Task SaveFileAsync(string folderName, string fileName, Stream packageFile, bool overwrite = true);
-
         Task<bool> IsAvailableAsync();
     }
 }
diff --git a/src/NuGetGallery/Services/IPackageFileService.cs b/src/NuGetGallery/Services/IPackageFileService.cs
index c0da685e94..ab03e3b1aa 100644
--- a/src/NuGetGallery/Services/IPackageFileService.cs
+++ b/src/NuGetGallery/Services/IPackageFileService.cs
@@ -1,5 +1,6 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
 using System;
 using System.IO;
 using System.Threading.Tasks;
@@ -7,7 +8,7 @@
 
 namespace NuGetGallery
 {
-    public interface IPackageFileService
+    public interface IPackageFileService : ICorePackageFileService
     {
         /// <summary>
         /// Creates an ActionResult that allows a third-party client to download the nupkg for the package.
@@ -24,21 +25,11 @@ public interface IPackageFileService
         /// </summary>
         Task DeletePackageFileAsync(string id, string version);
 
-        /// <summary>
-        /// Saves the contents of the package represented by the stream into the file storage.
-        /// </summary>
-        Task SavePackageFileAsync(Package package, Stream packageFile);
-
         /// <summary>
         /// Copies the contents of the package represented by the stream into the file storage backup location.
         /// </summary>
         Task StorePackageFileInBackupLocationAsync(Package package, Stream packageFile);
 
-        /// <summary>
-        /// Downloads the package from the file storage and reads it into a Stream asynchronously.
-        /// </summary>
-        Task<Stream> DownloadPackageFileAsync(Package packge);
-
         /// <summary>
         /// Deletes the package readme.md file from storage.
         /// </summary>
diff --git a/src/NuGetGallery/Services/NuGetExeDownloaderService.cs b/src/NuGetGallery/Services/NuGetExeDownloaderService.cs
index 83f44d2ab7..11a15a54f5 100644
--- a/src/NuGetGallery/Services/NuGetExeDownloaderService.cs
+++ b/src/NuGetGallery/Services/NuGetExeDownloaderService.cs
@@ -22,7 +22,7 @@ public NuGetExeDownloaderService(
 
         public Task<ActionResult> CreateNuGetExeDownloadActionResultAsync(Uri requestUrl)
         {
-            return _fileStorageService.CreateDownloadFileActionResultAsync(requestUrl, Constants.DownloadsFolderName, "nuget.exe");
+            return _fileStorageService.CreateDownloadFileActionResultAsync(requestUrl, CoreConstants.DownloadsFolderName, "nuget.exe");
         }
     }
 }
diff --git a/src/NuGetGallery/Services/PackageFileService.cs b/src/NuGetGallery/Services/PackageFileService.cs
index 6da95878b8..6e90489566 100644
--- a/src/NuGetGallery/Services/PackageFileService.cs
+++ b/src/NuGetGallery/Services/PackageFileService.cs
@@ -12,7 +12,7 @@
 
 namespace NuGetGallery
 {
-    public class PackageFileService : IPackageFileService
+    public class PackageFileService : CorePackageFileService, IPackageFileService
     {
         /// <summary>
         /// Active readme markdown file, formatted as 'active/{packageId}/{version}.md'
@@ -27,20 +27,21 @@ public class PackageFileService : IPackageFileService
         private readonly IFileStorageService _fileStorageService;
 
         public PackageFileService(IFileStorageService fileStorageService)
+            : base(fileStorageService)
         {
             _fileStorageService = fileStorageService;
         }
 
         public Task<ActionResult> CreateDownloadPackageActionResultAsync(Uri requestUrl, Package package)
         {
-            var fileName = BuildFileName(package, Constants.PackageFileSavePathTemplate, Constants.NuGetPackageFileExtension);
-            return _fileStorageService.CreateDownloadFileActionResultAsync(requestUrl, Constants.PackagesFolderName, fileName);
+            var fileName = BuildFileName(package, CoreConstants.PackageFileSavePathTemplate, CoreConstants.NuGetPackageFileExtension);
+            return _fileStorageService.CreateDownloadFileActionResultAsync(requestUrl, CoreConstants.PackagesFolderName, fileName);
         }
 
         public Task<ActionResult> CreateDownloadPackageActionResultAsync(Uri requestUrl, string id, string version)
         {
-            var fileName = BuildFileName(id, version, Constants.PackageFileSavePathTemplate, Constants.NuGetPackageFileExtension);
-            return _fileStorageService.CreateDownloadFileActionResultAsync(requestUrl, Constants.PackagesFolderName, fileName);
+            var fileName = BuildFileName(id, version, CoreConstants.PackageFileSavePathTemplate, CoreConstants.NuGetPackageFileExtension);
+            return _fileStorageService.CreateDownloadFileActionResultAsync(requestUrl, CoreConstants.PackagesFolderName, fileName);
         }
 
         public Task DeletePackageFileAsync(string id, string version)
@@ -55,19 +56,8 @@ public Task DeletePackageFileAsync(string id, string version)
                 throw new ArgumentNullException(nameof(version));
             }
 
-            var fileName = BuildFileName(id, version, Constants.PackageFileSavePathTemplate, Constants.NuGetPackageFileExtension);
-            return _fileStorageService.DeleteFileAsync(Constants.PackagesFolderName, fileName);
-        }
-
-        public Task SavePackageFileAsync(Package package, Stream packageFile)
-        {
-            if (packageFile == null)
-            {
-                throw new ArgumentNullException(nameof(packageFile));
-            }
-
-            var fileName = BuildFileName(package, Constants.PackageFileSavePathTemplate, Constants.NuGetPackageFileExtension);
-            return _fileStorageService.SaveFileAsync(Constants.PackagesFolderName, fileName, packageFile, overwrite: false);
+            var fileName = BuildFileName(id, version, CoreConstants.PackageFileSavePathTemplate, CoreConstants.NuGetPackageFileExtension);
+            return _fileStorageService.DeleteFileAsync(CoreConstants.PackagesFolderName, fileName);
         }
 
         public Task StorePackageFileInBackupLocationAsync(Package package, Stream packageFile)
@@ -86,18 +76,12 @@ public Task StorePackageFileInBackupLocationAsync(Package package, Stream packag
                 string.IsNullOrWhiteSpace(package.PackageRegistration.Id) ||
                 (string.IsNullOrWhiteSpace(package.NormalizedVersion) && string.IsNullOrWhiteSpace(package.Version)))
             {
-                throw new ArgumentException(Strings.PackageIsMissingRequiredData, nameof(package));
+                throw new ArgumentException(CoreStrings.PackageIsMissingRequiredData, nameof(package));
             }
 
             var fileName = BuildBackupFileName(package.PackageRegistration.Id, string.IsNullOrEmpty(package.NormalizedVersion) 
                 ? NuGetVersion.Parse(package.Version).ToNormalizedString() : package.NormalizedVersion, package.Hash);
-            return _fileStorageService.SaveFileAsync(Constants.PackageBackupsFolderName, fileName, packageFile);
-        }
-
-        public Task<Stream> DownloadPackageFileAsync(Package package)
-        {
-            var fileName = BuildFileName(package, Constants.PackageFileSavePathTemplate, Constants.NuGetPackageFileExtension);
-            return _fileStorageService.GetFileAsync(Constants.PackagesFolderName, fileName);
+            return _fileStorageService.SaveFileAsync(CoreConstants.PackageBackupsFolderName, fileName, packageFile);
         }
 
         /// <summary>
@@ -117,7 +101,7 @@ public Task DeleteReadMeMdFileAsync(Package package, bool isPending = false)
                 ReadMeFilePathTemplateActive;
             var fileName = BuildFileName(package, format, Constants.MarkdownFileExtension);
 
-            return _fileStorageService.DeleteFileAsync(Constants.PackageReadMesFolderName, fileName);
+            return _fileStorageService.DeleteFileAsync(CoreConstants.PackageReadMesFolderName, fileName);
         }
 
         /// <summary>
@@ -135,7 +119,7 @@ public async Task SavePendingReadMeMdFileAsync(Package package, string readMeMd)
             var fileName = BuildFileName(package, ReadMeFilePathTemplatePending, Constants.MarkdownFileExtension);
             using (var readMeMdStream = new MemoryStream(Encoding.UTF8.GetBytes(readMeMd)))
             {
-                await _fileStorageService.SaveFileAsync(Constants.PackageReadMesFolderName, fileName, readMeMdStream, overwrite: true);
+                await _fileStorageService.SaveFileAsync(CoreConstants.PackageReadMesFolderName, fileName, readMeMdStream, overwrite: true);
             }
         }
 
@@ -156,7 +140,7 @@ public async Task<string> DownloadReadMeMdFileAsync(Package package, bool isPend
                 ReadMeFilePathTemplateActive;
             var fileName = BuildFileName(package, format, Constants.MarkdownFileExtension);
 
-            using (var readMeMdStream = await _fileStorageService.GetFileAsync(Constants.PackageReadMesFolderName, fileName))
+            using (var readMeMdStream = await _fileStorageService.GetFileAsync(CoreConstants.PackageReadMesFolderName, fileName))
             {
                 // Note that fileStorageService implementations return null if not found.
                 if (readMeMdStream != null)
@@ -171,52 +155,6 @@ public async Task<string> DownloadReadMeMdFileAsync(Package package, bool isPend
             return null;
         }
 
-        private static string BuildFileName(string id, string version, string pathTemplate, string extension)
-        {
-            if (id == null)
-            {
-                throw new ArgumentNullException(nameof(id));
-            }
-
-            if (version == null)
-            {
-                throw new ArgumentNullException(nameof(version));
-            }
-
-            // Note: packages should be saved and retrieved in blob storage using the lower case version of their filename because
-            // a) package IDs can and did change case over time
-            // b) blob storage is case sensitive
-            // c) we don't want to hit the database just to look up the right case
-            // and remember - version can contain letters too.
-            return String.Format(
-                CultureInfo.InvariantCulture,
-                pathTemplate,
-                id.ToLowerInvariant(),
-                version.ToLowerInvariant(),
-                extension);
-        }
-
-        private static string BuildFileName(Package package, string format, string extension)
-        {
-            if (package == null)
-            {
-                throw new ArgumentNullException(nameof(package));
-            }
-
-            if (package.PackageRegistration == null ||
-                String.IsNullOrWhiteSpace(package.PackageRegistration.Id) ||
-                (String.IsNullOrWhiteSpace(package.NormalizedVersion) && String.IsNullOrWhiteSpace(package.Version)))
-            {
-                throw new ArgumentException(Strings.PackageIsMissingRequiredData, nameof(package));
-            }
-
-            return BuildFileName(
-                package.PackageRegistration.Id,
-                string.IsNullOrEmpty(package.NormalizedVersion) ?
-                    NuGetVersionFormatter.Normalize(package.Version) :
-                    package.NormalizedVersion, format, extension);
-        }
-
         private static string BuildBackupFileName(string id, string version, string hash)
         {
             if (id == null)
@@ -242,7 +180,7 @@ private static string BuildBackupFileName(string id, string version, string hash
                 id,
                 version,
                 HttpServerUtility.UrlTokenEncode(hashBytes),
-                Constants.NuGetPackageFileExtension);
+                CoreConstants.NuGetPackageFileExtension);
         }
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/UploadFileService.cs b/src/NuGetGallery/Services/UploadFileService.cs
index 1b0c8dc9b0..4cb988f244 100644
--- a/src/NuGetGallery/Services/UploadFileService.cs
+++ b/src/NuGetGallery/Services/UploadFileService.cs
@@ -25,7 +25,7 @@ public Task DeleteUploadFileAsync(int userKey)
 
             var uploadFileName = BuildFileName(userKey);
 
-            return _fileStorageService.DeleteFileAsync(Constants.UploadsFolderName, uploadFileName);
+            return _fileStorageService.DeleteFileAsync(CoreConstants.UploadsFolderName, uploadFileName);
         }
 
         public Task<Stream> GetUploadFileAsync(int userKey)
@@ -54,19 +54,19 @@ public Task SaveUploadFileAsync(int userKey, Stream packageFileStream)
             packageFileStream.Position = 0;
 
             var uploadFileName = BuildFileName(userKey);
-            return _fileStorageService.SaveFileAsync(Constants.UploadsFolderName, uploadFileName, packageFileStream);
+            return _fileStorageService.SaveFileAsync(CoreConstants.UploadsFolderName, uploadFileName, packageFileStream);
         }
 
         private static string BuildFileName(int userKey)
         {
-            return String.Format(CultureInfo.InvariantCulture, Constants.UploadFileNameTemplate, userKey, Constants.NuGetPackageFileExtension);
+            return String.Format(CultureInfo.InvariantCulture, Constants.UploadFileNameTemplate, userKey, CoreConstants.NuGetPackageFileExtension);
         }
 
         // Use the trick of a private core method that actually does the async stuff to allow for sync arg contract checking
         private async Task<Stream> GetUploadFileAsyncCore(int userKey)
         {
             var uploadFileName = BuildFileName(userKey);
-            return await _fileStorageService.GetFileAsync(Constants.UploadsFolderName, uploadFileName);
+            return await _fileStorageService.GetFileAsync(CoreConstants.UploadsFolderName, uploadFileName);
         }
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/Strings.Designer.cs b/src/NuGetGallery/Strings.Designer.cs
index 8dee9c92f0..29da145902 100644
--- a/src/NuGetGallery/Strings.Designer.cs
+++ b/src/NuGetGallery/Strings.Designer.cs
@@ -800,15 +800,6 @@ public static string PackageIsAlreadyCurated {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to The package is missing required data..
-        /// </summary>
-        public static string PackageIsMissingRequiredData {
-            get {
-                return ResourceManager.GetString("PackageIsMissingRequiredData", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to Package versions that differ only by metadata cannot be uploaded. A package with ID &apos;{0}&apos; and version &apos;{1}&apos; already exists and cannot be modified..
         /// </summary>
diff --git a/src/NuGetGallery/Strings.resx b/src/NuGetGallery/Strings.resx
index b99a11cf0e..75f7a855f1 100644
--- a/src/NuGetGallery/Strings.resx
+++ b/src/NuGetGallery/Strings.resx
@@ -320,9 +320,6 @@ The {1} Team</value>
   <data name="JobLogBlobNameInvalid" xml:space="preserve">
     <value>Job Log Blob name is invalid Bob! Expected [jobname].[yyyy-MM-dd].json or [jobname].json. Got: {0}</value>
   </data>
-  <data name="PackageIsMissingRequiredData" xml:space="preserve">
-    <value>The package is missing required data.</value>
-  </data>
   <data name="ErrorInSendingMail" xml:space="preserve">
     <value>Error in sending mail : {0}</value>
   </data>
diff --git a/src/NuGetGallery/WebApi/PlainTextResult.cs b/src/NuGetGallery/WebApi/PlainTextResult.cs
index de6776bd0e..ea58b23729 100644
--- a/src/NuGetGallery/WebApi/PlainTextResult.cs
+++ b/src/NuGetGallery/WebApi/PlainTextResult.cs
@@ -34,7 +34,7 @@ public Task<HttpResponseMessage> ExecuteAsync(CancellationToken cancellationToke
         {
             var response = new HttpResponseMessage()
             {
-                Content = new StringContent(Content, Encoding.UTF8, Constants.TextContentType),
+                Content = new StringContent(Content, Encoding.UTF8, CoreConstants.TextContentType),
                 RequestMessage = _request,
                 StatusCode = this.StatusCode
             };
diff --git a/tests/NuGetGallery.Core.Facts/NuGetGallery.Core.Facts.csproj b/tests/NuGetGallery.Core.Facts/NuGetGallery.Core.Facts.csproj
index bbade9e15b..c6d2be655c 100644
--- a/tests/NuGetGallery.Core.Facts/NuGetGallery.Core.Facts.csproj
+++ b/tests/NuGetGallery.Core.Facts/NuGetGallery.Core.Facts.csproj
@@ -145,7 +145,10 @@
     <Compile Include="Properties\AssemblyInfo.cs" />
     <Compile Include="Packaging\NupkgRewriterFacts.cs" />
     <Compile Include="SemVerLevelKeyFacts.cs" />
+    <Compile Include="Services\CloudBlobCoreFileStorageServiceFacts.cs" />
+    <Compile Include="Services\CorePackageFileServiceFacts.cs" />
     <Compile Include="Services\CorePackageServiceFacts.cs" />
+    <Compile Include="TestUtils\CoreMockExtensions.cs" />
     <Compile Include="Utilities\TestDirectory.cs" />
   </ItemGroup>
   <ItemGroup>
diff --git a/tests/NuGetGallery.Core.Facts/Services/CloudBlobCoreFileStorageServiceFacts.cs b/tests/NuGetGallery.Core.Facts/Services/CloudBlobCoreFileStorageServiceFacts.cs
new file mode 100644
index 0000000000..250daee105
--- /dev/null
+++ b/tests/NuGetGallery.Core.Facts/Services/CloudBlobCoreFileStorageServiceFacts.cs
@@ -0,0 +1,491 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Reflection;
+using System.Threading.Tasks;
+using Microsoft.WindowsAzure.Storage;
+using Microsoft.WindowsAzure.Storage.Blob;
+using Microsoft.WindowsAzure.Storage.Blob.Protocol;
+using Moq;
+using Xunit;
+using Xunit.Sdk;
+
+namespace NuGetGallery
+{
+    public class CloudBlobCoreFileStorageServiceFacts
+    {
+        private static CloudBlobCoreFileStorageService CreateService(
+            Mock<ICloudBlobClient> fakeBlobClient = null)
+        {
+            if (fakeBlobClient == null)
+            {
+                fakeBlobClient = new Mock<ICloudBlobClient>();
+            }
+
+            return new CloudBlobCoreFileStorageService(fakeBlobClient.Object);
+        }
+
+        private class FolderNamesDataAttribute : DataAttribute
+        {
+            public FolderNamesDataAttribute(bool includePermissions = false)
+            {
+                IncludePermissions = includePermissions;
+            }
+
+            private bool IncludePermissions { get; set; }
+
+            public override IEnumerable<object[]> GetData(MethodInfo testMethod)
+            {
+                var folderNames = new List<object[]>
+                    {
+                        new object[] { CoreConstants.PackagesFolderName, true },
+                        new object[] { CoreConstants.UploadsFolderName, false }
+                    };
+
+                if (!IncludePermissions)
+                {
+                    folderNames = folderNames.Select(fn => new[] { fn.ElementAt(0) }).ToList();
+                }
+
+                return folderNames;
+            }
+        }
+        
+        public class TheCtor
+        {
+            [Theory]
+            [FolderNamesData]
+            public async Task WillCreateABlobContainerForDemandedFoldersIfTheyDoNotExist(string folderName)
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0)).Verifiable();
+                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                var simpleCloudBlob = new Mock<ISimpleCloudBlob>();
+                simpleCloudBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>())).Returns(Task.FromResult(0));
+                fakeBlobContainer.Setup(x => x.GetBlobReference("x.txt")).Returns(simpleCloudBlob.Object);
+
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
+
+                var service = CreateService(fakeBlobClient);
+                await service.GetFileAsync(folderName, "x.txt");
+
+                fakeBlobClient.Verify(x => x.GetContainerReference(folderName));
+                fakeBlobContainer.Verify();
+            }
+
+            [Theory]
+            [FolderNamesData(includePermissions: true)]
+            public async Task WillSetPermissionsForDemandedFolderInBlobContainers(string folderName, bool isPublic)
+            {
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>()))
+                    .Returns(Task.FromResult(0))
+                    .Verifiable();
+
+                var simpleCloudBlob = new Mock<ISimpleCloudBlob>();
+                simpleCloudBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>())).Returns(Task.FromResult(0));
+
+                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                fakeBlobContainer.Setup(x => x.GetBlobReference("x.txt")).Returns(simpleCloudBlob.Object);
+
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
+
+                var service = CreateService(fakeBlobClient);
+                await service.GetFileAsync(folderName, "x.txt");
+
+                fakeBlobClient.Verify(x => x.GetContainerReference(folderName));
+                fakeBlobContainer.Verify();
+            }
+        }
+
+        public class TheDeletePackageFileMethod
+        {
+            [Theory]
+            [FolderNamesData]
+            public async Task WillGetTheBlobFromTheCorrectFolderContainer(string folderName)
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
+                    .Returns<string>(
+                        container =>
+                            {
+                                Mock<ICloudBlobContainer> blobContainer;
+                                if (container == folderName)
+                                {
+                                    blobContainer = fakeBlobContainer;
+                                }
+                                else
+                                {
+                                    blobContainer = new Mock<ICloudBlobContainer>();
+                                }
+                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                                return blobContainer.Object;
+                            });
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
+                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0));
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                await service.DeleteFileAsync(folderName, "theFileName");
+
+                fakeBlobContainer.Verify(x => x.GetBlobReference("theFileName"));
+            }
+
+            [Fact]
+            public async Task WillDeleteTheBlobIfItExists()
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0)).Verifiable();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                await service.DeleteFileAsync(CoreConstants.PackagesFolderName, "theFileName");
+
+                fakeBlob.Verify();
+            }
+        }
+
+        public class TheGetFileMethod
+        {
+            [Theory]
+            [InlineData(null)]
+            [InlineData("")]
+            [InlineData(" ")]
+            public async Task WillThrowIfFileNameIsNull(string fileName)
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                var ex = await Assert.ThrowsAsync<ArgumentNullException>(() => service.GetFileAsync("theFolderName", fileName));
+                Assert.Equal("fileName", ex.ParamName);
+            }
+
+            [Theory]
+            [InlineData(null)]
+            [InlineData("")]
+            [InlineData(" ")]
+            public async Task WillThrowIfFolderNameIsNull(string folderName)
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                var ex = await Assert.ThrowsAsync<ArgumentNullException>(() => service.GetFileAsync(folderName, "theFileName"));
+
+                Assert.Equal("folderName", ex.ParamName);
+            }
+
+            [Theory]
+            [FolderNamesData]
+            public async Task WillDownloadTheFile(string folderName)
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
+                    .Returns<string>(
+                        container =>
+                            {
+                                Mock<ICloudBlobContainer> containerMock;
+                                if (container == folderName)
+                                {
+                                    containerMock = fakeBlobContainer;
+                                }
+                                else
+                                {
+                                    containerMock = new Mock<ICloudBlobContainer>();
+                                }
+
+                                containerMock.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                                containerMock.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                                return containerMock.Object;
+                            });
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+                fakeBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>())).Returns(Task.FromResult(0)).Verifiable();
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                await service.GetFileAsync(folderName, "theFileName");
+
+                fakeBlob.Verify();
+            }
+
+            [Theory]
+            [FolderNamesData]
+            public async Task WillReturnTheStreamWhenTheFileExists(string folderName)
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0));
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
+                    .Returns<string>(
+                        container =>
+                            {
+                                Mock<ICloudBlobContainer> blobContainer;
+                                if (container == folderName)
+                                {
+                                    blobContainer = fakeBlobContainer;
+                                }
+                                else
+                                {
+                                    blobContainer = new Mock<ICloudBlobContainer>();
+                                }
+                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                                return blobContainer.Object;
+                            });
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+                fakeBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>()))
+                    .Callback<Stream, AccessCondition>((x, _) => { x.WriteByte(42); })
+                    .Returns(Task.FromResult(0));
+
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                var stream = await service.GetFileAsync(folderName, "theFileName");
+
+                Assert.Equal(42, ((MemoryStream)stream).ToArray()[0]);
+            }
+
+            [Theory]
+            [FolderNamesData]
+            public async Task WillReturnNullIfFileDoesNotExist(string folderName)
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
+                    .Returns<string>(
+                        container =>
+                            {
+                                Mock<ICloudBlobContainer> blobContainer;
+                                if (container == folderName)
+                                {
+                                    blobContainer = fakeBlobContainer;
+                                }
+                                else
+                                {
+                                    blobContainer = new Mock<ICloudBlobContainer>();
+                                }
+                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                                return blobContainer.Object;
+                            });
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+
+                fakeBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>())).Throws(
+                    new TestableStorageClientException { ErrorCode = BlobErrorCodeStrings.BlobNotFound });
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                var stream = await service.GetFileAsync(folderName, "theFileName");
+
+                Assert.Null(stream);
+            }
+
+            [Theory]
+            [FolderNamesData]
+            public async Task WillSetTheStreamPositionToZero(string folderName)
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
+                    .Returns<string>(
+                        container =>
+                            {
+                                Mock<ICloudBlobContainer> blobContainer;
+                                if (container == folderName)
+                                {
+                                    blobContainer = fakeBlobContainer;
+                                }
+                                else
+                                {
+                                    blobContainer = new Mock<ICloudBlobContainer>();
+                                }
+                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                                return blobContainer.Object;
+                            });
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+                fakeBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>()))
+                        .Callback<Stream, AccessCondition>((x, _) => { x.WriteByte(42); })
+                        .Returns(Task.FromResult(0));
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                var stream = await service.GetFileAsync(folderName, "theFileName");
+
+                Assert.Equal(0, stream.Position);
+            }
+        }
+
+        public class TheSaveFileMethod
+        {
+            [Theory]
+            [FolderNamesData]
+            public async Task WillGetTheBlobFromTheCorrectFolderContainer(string folderName)
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
+                    .Returns<string>(
+                        container =>
+                            {
+                                Mock<ICloudBlobContainer> blobContainer;
+                                if (container == folderName)
+                                {
+                                    blobContainer = fakeBlobContainer;
+                                }
+                                else
+                                {
+                                    blobContainer = new Mock<ICloudBlobContainer>();
+                                }
+                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                                return blobContainer.Object;
+                            });
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+                fakeBlob.Setup(x => x.Properties).Returns(new BlobProperties());
+                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
+                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.UploadFromStreamAsync(It.IsAny<Stream>(), true)).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0));
+
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                await service.SaveFileAsync(folderName, "theFileName", new MemoryStream());
+
+                fakeBlobContainer.Verify(x => x.GetBlobReference("theFileName"));
+            }
+
+            [Fact]
+            public async Task WillDeleteBlobIfItExistsAndOverwriteTrue()
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+                fakeBlob.Setup(x => x.UploadFromStreamAsync(It.IsAny<Stream>(), true)).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0)).Verifiable();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.Properties).Returns(new BlobProperties());
+                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                await service.SaveFileAsync(CoreConstants.PackagesFolderName, "theFileName", new MemoryStream());
+
+                fakeBlob.Verify();
+            }
+
+            [Fact]
+            public async Task WillThrowIfBlobExistsAndOverwriteFalse()
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+                fakeBlob
+                    .Setup(x => x.UploadFromStreamAsync(It.IsAny<Stream>(), false))
+                    .Throws(new StorageException(
+                        new RequestResult { HttpStatusCode = (int)HttpStatusCode.Conflict },
+                        "Conflict!",
+                        new Exception("inner")));
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.Properties).Returns(new BlobProperties());
+                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                await Assert.ThrowsAsync<InvalidOperationException>(async () => await service.SaveFileAsync(CoreConstants.PackagesFolderName, "theFileName", new MemoryStream(), overwrite: false));
+
+                fakeBlob.Verify();
+            }
+
+            [Fact]
+            public async Task WillUploadThePackageFileToTheBlob()
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+                fakeBlob.Setup(x => x.Properties).Returns(new BlobProperties());
+                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
+                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0));
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+                var fakePackageFile = new MemoryStream();
+                fakeBlob.Setup(x => x.UploadFromStreamAsync(fakePackageFile, true)).Returns(Task.FromResult(0)).Verifiable();
+
+                await service.SaveFileAsync(CoreConstants.PackagesFolderName, "theFileName", fakePackageFile);
+
+                fakeBlob.Verify();
+            }
+
+            [Theory]
+            [FolderNamesData]
+            public async Task WillSetTheBlobContentType(string folderName)
+            {
+                var fakeBlobClient = new Mock<ICloudBlobClient>();
+                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
+                var fakeBlob = new Mock<ISimpleCloudBlob>();
+                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
+                    .Returns<string>(
+                        container =>
+                            {
+                                Mock<ICloudBlobContainer> blobContainer;
+                                if (container == folderName)
+                                {
+                                    blobContainer = fakeBlobContainer;
+                                }
+                                else
+                                {
+                                    blobContainer = new Mock<ICloudBlobContainer>();
+                                }
+                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
+                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
+                                return blobContainer.Object;
+                            });
+                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
+                fakeBlob.Setup(x => x.Properties).Returns(new BlobProperties());
+                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
+                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.UploadFromStreamAsync(It.IsAny<Stream>(), true)).Returns(Task.FromResult(0));
+                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0));
+                var service = CreateService(fakeBlobClient: fakeBlobClient);
+
+                await service.SaveFileAsync(folderName, "theFileName", new MemoryStream());
+
+                Assert.Equal(CoreConstants.PackageContentType, fakeBlob.Object.Properties.ContentType);
+                fakeBlob.Verify(x => x.SetPropertiesAsync());
+            }
+        }
+    }
+}
diff --git a/tests/NuGetGallery.Core.Facts/Services/CorePackageFileServiceFacts.cs b/tests/NuGetGallery.Core.Facts/Services/CorePackageFileServiceFacts.cs
new file mode 100644
index 0000000000..bb643fcf6f
--- /dev/null
+++ b/tests/NuGetGallery.Core.Facts/Services/CorePackageFileServiceFacts.cs
@@ -0,0 +1,168 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading.Tasks;
+using Moq;
+using Xunit;
+
+namespace NuGetGallery
+{
+    public class CorePackageFileServiceFacts
+    {
+        public class TheSavePackageFileMethod
+        {
+            [Fact]
+            public void WillThrowIfPackageIsNull()
+            {
+                var service = CreateService();
+
+                var ex = Assert.Throws<ArgumentNullException>(() => service.SavePackageFileAsync(null, Stream.Null).Wait());
+
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public void WillThrowIfPackageFileIsNull()
+            {
+                var service = CreateService();
+
+                var ex = Assert.Throws<ArgumentNullException>(() => service.SavePackageFileAsync(new Package(), null).Wait());
+
+                Assert.Equal("packageFile", ex.ParamName);
+            }
+
+            [Fact]
+            public void WillThrowIfPackageIsMissingPackageRegistration()
+            {
+                var service = CreateService();
+                var package = new Package { PackageRegistration = null };
+
+                var ex = Assert.Throws<ArgumentException>(() => service.SavePackageFileAsync(package, CreatePackageFileStream()).Wait());
+
+                Assert.True(ex.Message.StartsWith("The package is missing required data."));
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public void WillThrowIfPackageIsMissingPackageRegistrationId()
+            {
+                var service = CreateService();
+                var packageRegistraion = new PackageRegistration { Id = null };
+                var package = new Package { PackageRegistration = packageRegistraion };
+
+                var ex = Assert.Throws<ArgumentException>(() => service.SavePackageFileAsync(package, CreatePackageFileStream()).Wait());
+
+                Assert.True(ex.Message.StartsWith("The package is missing required data."));
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public void WillThrowIfPackageIsMissingNormalizedVersionAndVersion()
+            {
+                var service = CreateService();
+                var packageRegistraion = new PackageRegistration { Id = "theId" };
+                var package = new Package { PackageRegistration = packageRegistraion, NormalizedVersion = null, Version = null };
+
+                var ex = Assert.Throws<ArgumentException>(() => service.SavePackageFileAsync(package, CreatePackageFileStream()).Wait());
+
+                Assert.True(ex.Message.StartsWith("The package is missing required data."));
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillUseNormalizedRegularVersionIfNormalizedVersionMissing()
+            {
+                var fileStorageSvc = new Mock<ICoreFileStorageService>();
+                var service = CreateService(fileStorageSvc: fileStorageSvc);
+                var packageRegistraion = new PackageRegistration { Id = "theId" };
+                var package = new Package { PackageRegistration = packageRegistraion, NormalizedVersion = null, Version = "01.01.01" };
+
+                fileStorageSvc.Setup(x => x.SaveFileAsync(It.IsAny<string>(), BuildFileName("theId", "1.1.1", CoreConstants.NuGetPackageFileExtension, CoreConstants.PackageFileSavePathTemplate), It.IsAny<Stream>(), It.Is<bool>(b => !b)))
+                    .Completes()
+                    .Verifiable();
+
+                await service.SavePackageFileAsync(package, CreatePackageFileStream());
+
+                fileStorageSvc.VerifyAll();
+            }
+
+            [Fact]
+            public async Task WillSaveTheFileViaTheFileStorageServiceUsingThePackagesFolder()
+            {
+                var fileStorageSvc = new Mock<ICoreFileStorageService>();
+                var service = CreateService(fileStorageSvc: fileStorageSvc);
+                fileStorageSvc.Setup(x => x.SaveFileAsync(CoreConstants.PackagesFolderName, It.IsAny<string>(), It.IsAny<Stream>(), It.Is<bool>(b => !b)))
+                    .Completes()
+                    .Verifiable();
+
+                await service.SavePackageFileAsync(CreatePackage(), CreatePackageFileStream());
+
+                fileStorageSvc.VerifyAll();
+            }
+
+            [Fact]
+            public async Task WillSaveTheFileViaTheFileStorageServiceUsingAFileNameWithIdAndNormalizedersion()
+            {
+                var fileStorageSvc = new Mock<ICoreFileStorageService>();
+                var service = CreateService(fileStorageSvc: fileStorageSvc);
+                fileStorageSvc.Setup(x => x.SaveFileAsync(It.IsAny<string>(), BuildFileName("theId", "theNormalizedVersion", CoreConstants.NuGetPackageFileExtension, CoreConstants.PackageFileSavePathTemplate), It.IsAny<Stream>(), It.Is<bool>(b => !b)))
+                    .Completes()
+                    .Verifiable();
+
+                await service.SavePackageFileAsync(CreatePackage(), CreatePackageFileStream());
+
+                fileStorageSvc.VerifyAll();
+            }
+
+            [Fact]
+            public async Task WillSaveTheFileStreamViaTheFileStorageService()
+            {
+                var fileStorageSvc = new Mock<ICoreFileStorageService>();
+                var fakeStream = new MemoryStream();
+                var service = CreateService(fileStorageSvc: fileStorageSvc);
+                fileStorageSvc.Setup(x => x.SaveFileAsync(It.IsAny<string>(), It.IsAny<string>(), fakeStream, It.Is<bool>(b => !b)))
+                    .Completes()
+                    .Verifiable();
+
+                await service.SavePackageFileAsync(CreatePackage(), fakeStream);
+
+                fileStorageSvc.VerifyAll();
+            }
+        }
+        
+        static string BuildFileName(
+            string id,
+            string version, string extension, string path)
+        {
+            return string.Format(
+                path,
+                id.ToLowerInvariant(),
+                NuGetVersionFormatter.Normalize(version).ToLowerInvariant(), // No matter what ends up getting passed in, the version should be normalized
+                extension);
+        }
+
+        static Package CreatePackage()
+        {
+            var packageRegistration = new PackageRegistration { Id = "theId", Packages = new HashSet<Package>() };
+            var package = new Package { Version = "theVersion", NormalizedVersion = "theNormalizedVersion", PackageRegistration = packageRegistration };
+            packageRegistration.Packages.Add(package);
+            return package;
+        }
+
+        static MemoryStream CreatePackageFileStream()
+        {
+            return new MemoryStream(new byte[] { 0, 0, 1, 0, 1, 0, 1, 0 }, 0, 8, true, true);
+        }
+
+        static CorePackageFileService CreateService(Mock<ICoreFileStorageService> fileStorageSvc = null)
+        {
+            fileStorageSvc = fileStorageSvc ?? new Mock<ICoreFileStorageService>();
+
+            return new CorePackageFileService(
+                fileStorageSvc.Object);
+        }
+    }
+}
diff --git a/tests/NuGetGallery.Core.Facts/TestUtils/CoreMockExtensions.cs b/tests/NuGetGallery.Core.Facts/TestUtils/CoreMockExtensions.cs
new file mode 100644
index 0000000000..13eab602a3
--- /dev/null
+++ b/tests/NuGetGallery.Core.Facts/TestUtils/CoreMockExtensions.cs
@@ -0,0 +1,19 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Threading.Tasks;
+using Moq.Language;
+using Moq.Language.Flow;
+
+namespace NuGetGallery
+{
+    public static class CoreMockExtensions
+    {
+        public static IReturnsResult<TMock> Completes<TMock>(this IReturns<TMock, Task> self)
+            where TMock : class
+        {
+            return self.Returns(Task.FromResult((object)null));
+        }
+    }
+}
+
diff --git a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
index fb05313a19..85b392500a 100644
--- a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
+++ b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
@@ -515,7 +515,6 @@
     <Compile Include="TestUtils\OwinAssert.cs" />
     <Compile Include="TestUtils\OwinTestExtensions.cs" />
     <Compile Include="TestUtils\ResultAssert.cs" />
-    <Compile Include="TestUtils\TaskAssert.cs" />
     <Compile Include="TestUtils\TestServiceUtility.cs" />
     <Compile Include="TestUtils\TestDataUtility.cs" />
     <Compile Include="TestUtils\TestUtility.cs" />
diff --git a/tests/NuGetGallery.Facts/Services/CloudBlobFileStorageServiceFacts.cs b/tests/NuGetGallery.Facts/Services/CloudBlobFileStorageServiceFacts.cs
index 1e19c152f2..2c33589145 100644
--- a/tests/NuGetGallery.Facts/Services/CloudBlobFileStorageServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/CloudBlobFileStorageServiceFacts.cs
@@ -3,16 +3,12 @@
 
 using System;
 using System.Collections.Generic;
-using System.IO;
 using System.Linq;
-using System.Net;
 using System.Reflection;
 using System.Threading.Tasks;
 using System.Web;
 using System.Web.Mvc;
-using Microsoft.WindowsAzure.Storage;
 using Microsoft.WindowsAzure.Storage.Blob;
-using Microsoft.WindowsAzure.Storage.Blob.Protocol;
 using Moq;
 using NuGetGallery.Configuration;
 using Xunit;
@@ -26,7 +22,6 @@ public class CloudBlobFileStorageServiceFacts
         private const string HttpsRequestUrlString = "https://nuget.org/api/v2/something";
 
         private static readonly Uri HttpRequestUrl = new Uri(HttpRequestUrlString);
-        private static readonly Uri HttpsRequestUrl = new Uri(HttpsRequestUrlString);
 
         private static CloudBlobFileStorageService CreateService(
             Mock<ICloudBlobClient> fakeBlobClient = null,
@@ -59,8 +54,8 @@ public override IEnumerable<object[]> GetData(MethodInfo testMethod)
             {
                 var folderNames = new List<object[]>
                     {
-                        new object[] { Constants.PackagesFolderName, true },
-                        new object[] { Constants.UploadsFolderName, false }
+                        new object[] { CoreConstants.PackagesFolderName, true },
+                        new object[] { CoreConstants.UploadsFolderName, false }
                     };
 
                 if (!IncludePermissions)
@@ -124,7 +119,7 @@ public async Task WillReturnARedirectResultToTheBlobUri(string requestUrl, strin
                 fakeBlob.Setup(x => x.Uri).Returns(new Uri(requestUri.Scheme + "://theUri"));
                 var service = CreateService(fakeBlobClient: fakeBlobClient);
 
-                var result = await service.CreateDownloadFileActionResultAsync(requestUri, Constants.PackagesFolderName, "theFileName") as RedirectResult;
+                var result = await service.CreateDownloadFileActionResultAsync(requestUri, CoreConstants.PackagesFolderName, "theFileName") as RedirectResult;
 
                 Assert.NotNull(result);
                 Assert.Equal(scheme + "theuri/", result.Url);
@@ -146,7 +141,7 @@ public async Task WillUseBlobUriPort(string requestUrl, string blobUrl, int expe
                 fakeBlob.Setup(x => x.Uri).Returns(new Uri(blobUrl));
                 var service = CreateService(fakeBlobClient: fakeBlobClient);
 
-                var result = await service.CreateDownloadFileActionResultAsync(new Uri(requestUrl), Constants.PackagesFolderName, "theFileName") as RedirectResult;
+                var result = await service.CreateDownloadFileActionResultAsync(new Uri(requestUrl), CoreConstants.PackagesFolderName, "theFileName") as RedirectResult;
                 var redirectUrl = new Uri(result.Url);
                 Assert.Equal(expectedPort, redirectUrl.Port);
             }
@@ -168,7 +163,7 @@ public async Task WillUseISourceDestinationRedirectPolicy()
 
                 var result = await service.CreateDownloadFileActionResultAsync(
                     new Uri(HttpsRequestUrlString), 
-                    Constants.PackagesFolderName, 
+                    CoreConstants.PackagesFolderName, 
                     "theFileName") as RedirectResult;
                 fakePolicy.Verify();
             }
@@ -191,443 +186,11 @@ public async Task WillThrowIfRedirectIsNotAllowed()
                 await Assert.ThrowsAsync<InvalidOperationException>(
                     () => service.CreateDownloadFileActionResultAsync(
                         new Uri(HttpsRequestUrlString), 
-                        Constants.PackagesFolderName, "theFileName")
+                        CoreConstants.PackagesFolderName, "theFileName")
                     );
             }
         }
-
-        public class TheCtor
-        {
-            [Theory]
-            [FolderNamesData]
-            public async Task WillCreateABlobContainerForDemandedFoldersIfTheyDoNotExist(string folderName)
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0)).Verifiable();
-                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                var simpleCloudBlob = new Mock<ISimpleCloudBlob>();
-                simpleCloudBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>())).Returns(Task.FromResult(0));
-                fakeBlobContainer.Setup(x => x.GetBlobReference("x.txt")).Returns(simpleCloudBlob.Object);
-
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
-
-                var service = CreateService(fakeBlobClient);
-                await service.GetFileAsync(folderName, "x.txt");
-
-                fakeBlobClient.Verify(x => x.GetContainerReference(folderName));
-                fakeBlobContainer.Verify();
-            }
-
-            [Theory]
-            [FolderNamesData(includePermissions: true)]
-            public async Task WillSetPermissionsForDemandedFolderInBlobContainers(string folderName, bool isPublic)
-            {
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>()))
-                    .Returns(Task.FromResult(0))
-                    .Verifiable();
-
-                var simpleCloudBlob = new Mock<ISimpleCloudBlob>();
-                simpleCloudBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>())).Returns(Task.FromResult(0));
-
-                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                fakeBlobContainer.Setup(x => x.GetBlobReference("x.txt")).Returns(simpleCloudBlob.Object);
-
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
-
-                var service = CreateService(fakeBlobClient);
-                await service.GetFileAsync(folderName, "x.txt");
-
-                fakeBlobClient.Verify(x => x.GetContainerReference(folderName));
-                fakeBlobContainer.Verify();
-            }
-        }
-
-        public class TheDeletePackageFileMethod
-        {
-            [Theory]
-            [FolderNamesData]
-            public async Task WillGetTheBlobFromTheCorrectFolderContainer(string folderName)
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
-                    .Returns<string>(
-                        container =>
-                            {
-                                Mock<ICloudBlobContainer> blobContainer;
-                                if (container == folderName)
-                                {
-                                    blobContainer = fakeBlobContainer;
-                                }
-                                else
-                                {
-                                    blobContainer = new Mock<ICloudBlobContainer>();
-                                }
-                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                                return blobContainer.Object;
-                            });
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
-                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0));
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                await service.DeleteFileAsync(folderName, "theFileName");
-
-                fakeBlobContainer.Verify(x => x.GetBlobReference("theFileName"));
-            }
-
-            [Fact]
-            public async Task WillDeleteTheBlobIfItExists()
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0)).Verifiable();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                await service.DeleteFileAsync(Constants.PackagesFolderName, "theFileName");
-
-                fakeBlob.Verify();
-            }
-        }
-
-        public class TheGetFileMethod
-        {
-            [Theory]
-            [InlineData(null)]
-            [InlineData("")]
-            [InlineData(" ")]
-            public void WillThrowIfFileNameIsNull(string fileName)
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                var ex = TaskAssert.ThrowsAsync<ArgumentNullException>(() => service.GetFileAsync("theFolderName", fileName));
-                Assert.Equal("fileName", ex.ParamName);
-            }
-
-            [Theory]
-            [InlineData(null)]
-            [InlineData("")]
-            [InlineData(" ")]
-            public void WillThrowIfFolderNameIsNull(string folderName)
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                var ex = TaskAssert.ThrowsAsync<ArgumentNullException>(() => service.GetFileAsync(folderName, "theFileName"));
-
-                Assert.Equal("folderName", ex.ParamName);
-            }
-
-            [Theory]
-            [FolderNamesData]
-            public async Task WillDownloadTheFile(string folderName)
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
-                    .Returns<string>(
-                        container =>
-                            {
-                                Mock<ICloudBlobContainer> containerMock;
-                                if (container == folderName)
-                                {
-                                    containerMock = fakeBlobContainer;
-                                }
-                                else
-                                {
-                                    containerMock = new Mock<ICloudBlobContainer>();
-                                }
-
-                                containerMock.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                                containerMock.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                                return containerMock.Object;
-                            });
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-                fakeBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>())).Returns(Task.FromResult(0)).Verifiable();
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                await service.GetFileAsync(folderName, "theFileName");
-
-                fakeBlob.Verify();
-            }
-
-            [Theory]
-            [FolderNamesData]
-            public async Task WillReturnTheStreamWhenTheFileExists(string folderName)
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0));
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
-                    .Returns<string>(
-                        container =>
-                            {
-                                Mock<ICloudBlobContainer> blobContainer;
-                                if (container == folderName)
-                                {
-                                    blobContainer = fakeBlobContainer;
-                                }
-                                else
-                                {
-                                    blobContainer = new Mock<ICloudBlobContainer>();
-                                }
-                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                                return blobContainer.Object;
-                            });
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-                fakeBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>()))
-                    .Callback<Stream, AccessCondition>((x, _) => { x.WriteByte(42); })
-                    .Returns(Task.FromResult(0));
-
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                var stream = await service.GetFileAsync(folderName, "theFileName");
-
-                Assert.Equal(42, ((MemoryStream)stream).ToArray()[0]);
-            }
-
-            [Theory]
-            [FolderNamesData]
-            public async Task WillReturnNullIfFileDoesNotExist(string folderName)
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
-                    .Returns<string>(
-                        container =>
-                            {
-                                Mock<ICloudBlobContainer> blobContainer;
-                                if (container == folderName)
-                                {
-                                    blobContainer = fakeBlobContainer;
-                                }
-                                else
-                                {
-                                    blobContainer = new Mock<ICloudBlobContainer>();
-                                }
-                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                                return blobContainer.Object;
-                            });
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-
-                fakeBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>())).Throws(
-                    new TestableStorageClientException { ErrorCode = BlobErrorCodeStrings.BlobNotFound });
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                var stream = await service.GetFileAsync(folderName, "theFileName");
-
-                Assert.Null(stream);
-            }
-
-            [Theory]
-            [FolderNamesData]
-            public async Task WillSetTheStreamPositionToZero(string folderName)
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
-                    .Returns<string>(
-                        container =>
-                            {
-                                Mock<ICloudBlobContainer> blobContainer;
-                                if (container == folderName)
-                                {
-                                    blobContainer = fakeBlobContainer;
-                                }
-                                else
-                                {
-                                    blobContainer = new Mock<ICloudBlobContainer>();
-                                }
-                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                                return blobContainer.Object;
-                            });
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-                fakeBlob.Setup(x => x.DownloadToStreamAsync(It.IsAny<Stream>(), It.IsAny<AccessCondition>()))
-                        .Callback<Stream, AccessCondition>((x, _) => { x.WriteByte(42); })
-                        .Returns(Task.FromResult(0));
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                var stream = await service.GetFileAsync(folderName, "theFileName");
-
-                Assert.Equal(0, stream.Position);
-            }
-        }
-
-        public class TheSaveFileMethod
-        {
-            [Theory]
-            [FolderNamesData]
-            public async Task WillGetTheBlobFromTheCorrectFolderContainer(string folderName)
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
-                    .Returns<string>(
-                        container =>
-                            {
-                                Mock<ICloudBlobContainer> blobContainer;
-                                if (container == folderName)
-                                {
-                                    blobContainer = fakeBlobContainer;
-                                }
-                                else
-                                {
-                                    blobContainer = new Mock<ICloudBlobContainer>();
-                                }
-                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                                return blobContainer.Object;
-                            });
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-                fakeBlob.Setup(x => x.Properties).Returns(new BlobProperties());
-                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
-                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.UploadFromStreamAsync(It.IsAny<Stream>(), true)).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0));
-
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                await service.SaveFileAsync(folderName, "theFileName", new MemoryStream());
-
-                fakeBlobContainer.Verify(x => x.GetBlobReference("theFileName"));
-            }
-
-            [Fact]
-            public async Task WillDeleteBlobIfItExistsAndOverwriteTrue()
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-                fakeBlob.Setup(x => x.UploadFromStreamAsync(It.IsAny<Stream>(), true)).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0)).Verifiable();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.Properties).Returns(new BlobProperties());
-                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                await service.SaveFileAsync(Constants.PackagesFolderName, "theFileName", new MemoryStream());
-
-                fakeBlob.Verify();
-            }
-
-            [Fact]
-            public async Task WillThrowIfBlobExistsAndOverwriteFalse()
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-                fakeBlob
-                    .Setup(x => x.UploadFromStreamAsync(It.IsAny<Stream>(), false))
-                    .Throws(new StorageException(
-                        new RequestResult { HttpStatusCode = (int)HttpStatusCode.Conflict },
-                        "Conflict!",
-                        new Exception("inner")));
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.Properties).Returns(new BlobProperties());
-                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                await Assert.ThrowsAsync<InvalidOperationException>(async () => await service.SaveFileAsync(Constants.PackagesFolderName, "theFileName", new MemoryStream(), overwrite: false));
-
-                fakeBlob.Verify();
-            }
-
-            [Fact]
-            public async Task WillUploadThePackageFileToTheBlob()
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                fakeBlobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                fakeBlobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>())).Returns(fakeBlobContainer.Object);
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-                fakeBlob.Setup(x => x.Properties).Returns(new BlobProperties());
-                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
-                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0));
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-                var fakePackageFile = new MemoryStream();
-                fakeBlob.Setup(x => x.UploadFromStreamAsync(fakePackageFile, true)).Returns(Task.FromResult(0)).Verifiable();
-
-                await service.SaveFileAsync(Constants.PackagesFolderName, "theFileName", fakePackageFile);
-
-                fakeBlob.Verify();
-            }
-
-            [Theory]
-            [FolderNamesData]
-            public async Task WillSetTheBlobContentType(string folderName)
-            {
-                var fakeBlobClient = new Mock<ICloudBlobClient>();
-                var fakeBlobContainer = new Mock<ICloudBlobContainer>();
-                var fakeBlob = new Mock<ISimpleCloudBlob>();
-                fakeBlobClient.Setup(x => x.GetContainerReference(It.IsAny<string>()))
-                    .Returns<string>(
-                        container =>
-                            {
-                                Mock<ICloudBlobContainer> blobContainer;
-                                if (container == folderName)
-                                {
-                                    blobContainer = fakeBlobContainer;
-                                }
-                                else
-                                {
-                                    blobContainer = new Mock<ICloudBlobContainer>();
-                                }
-                                blobContainer.Setup(x => x.CreateIfNotExistAsync()).Returns(Task.FromResult(0));
-                                blobContainer.Setup(x => x.SetPermissionsAsync(It.IsAny<BlobContainerPermissions>())).Returns(Task.FromResult(0));
-                                return blobContainer.Object;
-                            });
-                fakeBlobContainer.Setup(x => x.GetBlobReference(It.IsAny<string>())).Returns(fakeBlob.Object);
-                fakeBlob.Setup(x => x.Properties).Returns(new BlobProperties());
-                fakeBlob.Setup(x => x.Uri).Returns(new Uri("http://theUri"));
-                fakeBlob.Setup(x => x.DeleteIfExistsAsync()).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.UploadFromStreamAsync(It.IsAny<Stream>(), true)).Returns(Task.FromResult(0));
-                fakeBlob.Setup(x => x.SetPropertiesAsync()).Returns(Task.FromResult(0));
-                var service = CreateService(fakeBlobClient: fakeBlobClient);
-
-                await service.SaveFileAsync(folderName, "theFileName", new MemoryStream());
-
-                Assert.Equal(Constants.PackageContentType, fakeBlob.Object.Properties.ContentType);
-                fakeBlob.Verify(x => x.SetPropertiesAsync());
-            }
-        }
-
+        
         private static HttpContextBase GetContext(string protocol = "http://")
         {
             var httpRequest = new Mock<HttpRequestBase>();
diff --git a/tests/NuGetGallery.Facts/Services/ContentServiceFacts.cs b/tests/NuGetGallery.Facts/Services/ContentServiceFacts.cs
index 11000217af..b1b019810d 100644
--- a/tests/NuGetGallery.Facts/Services/ContentServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/ContentServiceFacts.cs
@@ -96,7 +96,7 @@ public async Task GivenAContentItemNameAndACachedValueThatHasNotExpired_ItShould
                 Assert.Equal(CachedContent, actual.ToString());
                 contentService.MockFileStorage
                               .Verify(
-                                fs => fs.GetFileReferenceAsync(Constants.ContentFolderName, "TestContentItem.md", It.IsAny<string>()),
+                                fs => fs.GetFileReferenceAsync(CoreConstants.ContentFolderName, "TestContentItem.md", It.IsAny<string>()),
                                 Times.Never());
             }
 
@@ -118,7 +118,7 @@ public async Task GivenAContentItemNameAndACachedValueThatHasExpiredButNotChange
                 // Assert
                 Assert.Equal(CachedContent, actual.ToString());
                 contentService.MockFileStorage
-                              .Verify(fs => fs.GetFileReferenceAsync(Constants.ContentFolderName, "TestContentItem.md", cachedContentId));
+                              .Verify(fs => fs.GetFileReferenceAsync(CoreConstants.ContentFolderName, "TestContentItem.md", cachedContentId));
                 Assert.Equal(0, file.OpenCount); // Make sure we never tried to open the file.
                 
                 var updatedCache = contentService.GetCached("TestContentItem");
@@ -146,7 +146,7 @@ public async Task GivenAContentItemAndACachedValueThatHasExpiredAndChanged_ItSho
                 // Assert
                 Assert.Equal(RenderedNewContent, actual.ToString());
                 contentService.MockFileStorage
-                              .Verify(fs => fs.GetFileReferenceAsync(Constants.ContentFolderName, "TestContentItem.md", cachedContentId));
+                              .Verify(fs => fs.GetFileReferenceAsync(CoreConstants.ContentFolderName, "TestContentItem.md", cachedContentId));
                 Assert.Equal(1, file.OpenCount); // Make sure we never tried to open the file.
 
                 var updatedCache = contentService.GetCached("TestContentItem");
@@ -230,7 +230,7 @@ public async Task GivenAContentItemNameAndACachedValueThatHasNotExpired_ItShould
                 Assert.Equal(CachedContent, actual.ToString());
                 contentService.MockFileStorage
                               .Verify(
-                                fs => fs.GetFileReferenceAsync(Constants.ContentFolderName, "TestContentItem.md", It.IsAny<string>()),
+                                fs => fs.GetFileReferenceAsync(CoreConstants.ContentFolderName, "TestContentItem.md", It.IsAny<string>()),
                                 Times.Never());
             }
 
@@ -252,7 +252,7 @@ public async Task GivenAContentItemNameAndACachedValueThatHasExpiredButNotChange
                 // Assert
                 Assert.Equal(CachedContent, actual.ToString());
                 contentService.MockFileStorage
-                              .Verify(fs => fs.GetFileReferenceAsync(Constants.ContentFolderName, "TestContentItem.md", cachedContentId));
+                              .Verify(fs => fs.GetFileReferenceAsync(CoreConstants.ContentFolderName, "TestContentItem.md", cachedContentId));
                 Assert.Equal(0, file.OpenCount); // Make sure we never tried to open the file.
 
                 var updatedCache = contentService.GetCached("TestContentItem");
@@ -280,7 +280,7 @@ public async Task GivenAContentItemAndACachedValueThatHasExpiredAndChanged_ItSho
                 // Assert
                 Assert.Equal(RenderedNewContent, actual.ToString());
                 contentService.MockFileStorage
-                              .Verify(fs => fs.GetFileReferenceAsync(Constants.ContentFolderName, "TestContentItem.md", cachedContentId));
+                              .Verify(fs => fs.GetFileReferenceAsync(CoreConstants.ContentFolderName, "TestContentItem.md", cachedContentId));
                 Assert.Equal(1, file.OpenCount); // Make sure we never tried to open the file.
 
                 var updatedCache = contentService.GetCached("TestContentItem");
@@ -320,10 +320,10 @@ public ContentItem GetCached(string key)
             public void SetFile(string filename, string cachedContentId, IFileReference file)
             {
                 MockFileStorage
-                    .Setup(fs => fs.GetFileReferenceAsync(Constants.ContentFolderName, filename, cachedContentId))
+                    .Setup(fs => fs.GetFileReferenceAsync(CoreConstants.ContentFolderName, filename, cachedContentId))
                     .Returns(Task.FromResult<IFileReference>(file));
                 MockFileStorage
-                    .Setup(fs => fs.GetFileReferenceAsync(Constants.ContentFolderName, It.Is<string>(s => !s.Equals(filename)), It.IsAny<string>()))
+                    .Setup(fs => fs.GetFileReferenceAsync(CoreConstants.ContentFolderName, It.Is<string>(s => !s.Equals(filename)), It.IsAny<string>()))
                     .Returns(Task.FromResult<IFileReference>(null));
             }
 
diff --git a/tests/NuGetGallery.Facts/Services/FileSystemFileStorageServiceFacts.cs b/tests/NuGetGallery.Facts/Services/FileSystemFileStorageServiceFacts.cs
index 9ca9027176..7395046d1c 100644
--- a/tests/NuGetGallery.Facts/Services/FileSystemFileStorageServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/FileSystemFileStorageServiceFacts.cs
@@ -76,7 +76,7 @@ public async Task WillThrowIfFileNameIsNull(string fileName)
                 var ex = await Assert.ThrowsAsync<ArgumentNullException>(
                     () => service.CreateDownloadFileActionResultAsync(
                         HttpRequestUrl,
-                        Constants.PackagesFolderName,
+                        CoreConstants.PackagesFolderName,
                         fileName));
 
                 Assert.Equal("fileName", ex.ParamName);
@@ -87,11 +87,11 @@ public async Task WillReturnAFilePathResultWithTheFilePath()
             {
                 var service = CreateService();
 
-                var result = await service.CreateDownloadFileActionResultAsync(HttpRequestUrl, Constants.PackagesFolderName, "theFileName") as FilePathResult;
+                var result = await service.CreateDownloadFileActionResultAsync(HttpRequestUrl, CoreConstants.PackagesFolderName, "theFileName") as FilePathResult;
 
                 Assert.NotNull(result);
                 Assert.Equal(
-                    Path.Combine(FakeConfiguredFileStorageDirectory, Constants.PackagesFolderName, "theFileName"),
+                    Path.Combine(FakeConfiguredFileStorageDirectory, CoreConstants.PackagesFolderName, "theFileName"),
                     result.FileName);
             }
 
@@ -102,7 +102,7 @@ public async Task WillReturnAnHttpNotFoundResultWhenTheFileDoesNotExist()
                 fakeFileSystemService.Setup(x => x.FileExists(It.IsAny<string>())).Returns(false);
                 var service = CreateService(fileSystemService: fakeFileSystemService);
 
-                var result = await service.CreateDownloadFileActionResultAsync(HttpRequestUrl, Constants.PackagesFolderName, "theFileName") as HttpNotFoundResult;
+                var result = await service.CreateDownloadFileActionResultAsync(HttpRequestUrl, CoreConstants.PackagesFolderName, "theFileName") as HttpNotFoundResult;
 
                 Assert.NotNull(result);
             }
@@ -112,10 +112,10 @@ public async Task WillSetTheResultContentTypeForThePackagesFolder()
             {
                 var service = CreateService();
 
-                var result = await service.CreateDownloadFileActionResultAsync(HttpRequestUrl, Constants.PackagesFolderName, "theFileName") as FilePathResult;
+                var result = await service.CreateDownloadFileActionResultAsync(HttpRequestUrl, CoreConstants.PackagesFolderName, "theFileName") as FilePathResult;
 
                 Assert.NotNull(result);
-                Assert.Equal(Constants.PackageContentType, result.ContentType);
+                Assert.Equal(CoreConstants.PackageContentType, result.ContentType);
             }
 
             [Fact]
@@ -123,7 +123,7 @@ public async Task WillSetTheResultDownloadFilePath()
             {
                 var service = CreateService();
 
-                var result = await service.CreateDownloadFileActionResultAsync(HttpRequestUrl, Constants.PackagesFolderName, "theFileName") as FilePathResult;
+                var result = await service.CreateDownloadFileActionResultAsync(HttpRequestUrl, CoreConstants.PackagesFolderName, "theFileName") as FilePathResult;
 
                 Assert.NotNull(result);
                 Assert.Equal(
@@ -158,7 +158,7 @@ public async Task WillThrowIfFileNameIsNull(string fileName)
 
                 var ex = await Assert.ThrowsAsync<ArgumentNullException>(
                     () => service.DeleteFileAsync(
-                        Constants.PackagesFolderName,
+                        CoreConstants.PackagesFolderName,
                         fileName));
 
                 Assert.Equal("fileName", ex.ParamName);
@@ -171,11 +171,11 @@ public void WillDeleteTheFileIfItExists()
                 fakeFileSystemService.Setup(x => x.FileExists(It.IsAny<string>())).Returns(true);
                 var service = CreateService(fileSystemService: fakeFileSystemService);
 
-                service.DeleteFileAsync(Constants.PackagesFolderName, "theFileName");
+                service.DeleteFileAsync(CoreConstants.PackagesFolderName, "theFileName");
 
                 fakeFileSystemService.Verify(
                     x => x.DeleteFile(
-                        Path.Combine(FakeConfiguredFileStorageDirectory, Constants.PackagesFolderName, "theFileName")));
+                        Path.Combine(FakeConfiguredFileStorageDirectory, CoreConstants.PackagesFolderName, "theFileName")));
             }
 
             [Fact]
@@ -187,7 +187,7 @@ public void WillNotDeleteTheFileIfItDoesNotExist()
                 fakeFileSystemService.Setup(x => x.DeleteFile(It.IsAny<string>())).Callback(() => deleteWasInvoked = true);
                 var service = CreateService(fileSystemService: fakeFileSystemService);
 
-                service.DeleteFileAsync(Constants.PackagesFolderName, "theFileName");
+                service.DeleteFileAsync(CoreConstants.PackagesFolderName, "theFileName");
 
                 Assert.False(deleteWasInvoked);
             }
@@ -219,7 +219,7 @@ public async Task WillThrowIfFileNameIsNull(string fileName)
 
                 var ex = await Assert.ThrowsAsync<ArgumentNullException>(
                     () => service.GetFileAsync(
-                        Constants.PackagesFolderName,
+                        CoreConstants.PackagesFolderName,
                         fileName));
 
                 Assert.Equal("fileName", ex.ParamName);
diff --git a/tests/NuGetGallery.Facts/Services/PackageFileServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageFileServiceFacts.cs
index 6d714f02b1..63a6faf5fd 100644
--- a/tests/NuGetGallery.Facts/Services/PackageFileServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageFileServiceFacts.cs
@@ -46,7 +46,7 @@ public async Task WillDeleteTheFileViaTheFileStorageServiceUsingThePackagesFolde
             {
                 var fileStorageSvc = new Mock<IFileStorageService>();
                 var service = CreateService(fileStorageSvc: fileStorageSvc);
-                fileStorageSvc.Setup(x => x.DeleteFileAsync(Constants.PackagesFolderName, It.IsAny<string>()))
+                fileStorageSvc.Setup(x => x.DeleteFileAsync(CoreConstants.PackagesFolderName, It.IsAny<string>()))
                     .Completes()
                     .Verifiable();
 
@@ -60,7 +60,7 @@ public async Task WillDeleteTheFileViaTheFileStorageServiceUsingAFileNameWithIdA
             {
                 var fileStorageSvc = new Mock<IFileStorageService>();
                 var service = CreateService(fileStorageSvc: fileStorageSvc);
-                fileStorageSvc.Setup(x => x.DeleteFileAsync(It.IsAny<string>(), BuildFileName("theId", "theVersion", Constants.NuGetPackageFileExtension, Constants.PackageFileSavePathTemplate)))
+                fileStorageSvc.Setup(x => x.DeleteFileAsync(It.IsAny<string>(), BuildFileName("theId", "theVersion", CoreConstants.NuGetPackageFileExtension, CoreConstants.PackageFileSavePathTemplate)))
                     .Completes()
                     .Verifiable();
 
@@ -125,7 +125,7 @@ public async Task WillGetAResultFromTheFileStorageServiceUsingThePackagesFolder(
             {
                 var fileStorageSvc = new Mock<IFileStorageService>();
                 var service = CreateService(fileStorageSvc: fileStorageSvc);
-                fileStorageSvc.Setup(x => x.CreateDownloadFileActionResultAsync(new Uri("http://fake"), Constants.PackagesFolderName, It.IsAny<string>()))
+                fileStorageSvc.Setup(x => x.CreateDownloadFileActionResultAsync(new Uri("http://fake"), CoreConstants.PackagesFolderName, It.IsAny<string>()))
                     .CompletesWithNull()
                     .Verifiable();
 
@@ -139,7 +139,7 @@ public async Task WillGetAResultFromTheFileStorageServiceUsingAFileNameWithIdAnd
             {
                 var fileStorageSvc = new Mock<IFileStorageService>();
                 var service = CreateService(fileStorageSvc: fileStorageSvc);
-                fileStorageSvc.Setup(x => x.CreateDownloadFileActionResultAsync(new Uri("http://fake"), It.IsAny<string>(), BuildFileName("theId", "theNormalizedVersion", Constants.NuGetPackageFileExtension, Constants.PackageFileSavePathTemplate)))
+                fileStorageSvc.Setup(x => x.CreateDownloadFileActionResultAsync(new Uri("http://fake"), It.IsAny<string>(), BuildFileName("theId", "theNormalizedVersion", CoreConstants.NuGetPackageFileExtension, CoreConstants.PackageFileSavePathTemplate)))
                     .CompletesWithNull()
                     .Verifiable();
 
@@ -156,7 +156,7 @@ public async Task WillUseNormalizedRegularVersionIfNormalizedVersionMissing()
                 var packageRegistraion = new PackageRegistration { Id = "theId" };
                 var package = new Package { PackageRegistration = packageRegistraion, NormalizedVersion = null, Version = "01.01.01" };
 
-                fileStorageSvc.Setup(x => x.CreateDownloadFileActionResultAsync(new Uri("http://fake"), It.IsAny<string>(), BuildFileName("theId", "1.1.1",Constants.NuGetPackageFileExtension, Constants.PackageFileSavePathTemplate)))
+                fileStorageSvc.Setup(x => x.CreateDownloadFileActionResultAsync(new Uri("http://fake"), It.IsAny<string>(), BuildFileName("theId", "1.1.1", CoreConstants.NuGetPackageFileExtension, CoreConstants.PackageFileSavePathTemplate)))
                     .CompletesWithNull()
                     .Verifiable();
 
@@ -180,128 +180,7 @@ public async Task WillReturnTheResultFromTheFileStorageService()
                 Assert.Equal(fakeResult, result);
             }
         }
-
-        public class TheSavePackageFileMethod
-        {
-            [Fact]
-            public void WillThrowIfPackageIsNull()
-            {
-                var service = CreateService();
-
-                var ex = Assert.Throws<ArgumentNullException>(() => service.SavePackageFileAsync(null, Stream.Null).Wait());
-
-                Assert.Equal("package", ex.ParamName);
-            }
-
-            [Fact]
-            public void WillThrowIfPackageFileIsNull()
-            {
-                var service = CreateService();
-
-                var ex = Assert.Throws<ArgumentNullException>(() => service.SavePackageFileAsync(new Package(), null).Wait());
-
-                Assert.Equal("packageFile", ex.ParamName);
-            }
-
-            [Fact]
-            public void WillThrowIfPackageIsMissingPackageRegistration()
-            {
-                var service = CreateService();
-                var package = new Package { PackageRegistration = null };
-
-                var ex = Assert.Throws<ArgumentException>(() => service.SavePackageFileAsync(package, CreatePackageFileStream()).Wait());
-
-                Assert.True(ex.Message.StartsWith("The package is missing required data."));
-                Assert.Equal("package", ex.ParamName);
-            }
-
-            [Fact]
-            public void WillThrowIfPackageIsMissingPackageRegistrationId()
-            {
-                var service = CreateService();
-                var packageRegistraion = new PackageRegistration { Id = null };
-                var package = new Package { PackageRegistration = packageRegistraion };
-
-                var ex = Assert.Throws<ArgumentException>(() => service.SavePackageFileAsync(package, CreatePackageFileStream()).Wait());
-
-                Assert.True(ex.Message.StartsWith("The package is missing required data."));
-                Assert.Equal("package", ex.ParamName);
-            }
-
-            [Fact]
-            public void WillThrowIfPackageIsMissingNormalizedVersionAndVersion()
-            {
-                var service = CreateService();
-                var packageRegistraion = new PackageRegistration { Id = "theId" };
-                var package = new Package { PackageRegistration = packageRegistraion, NormalizedVersion = null, Version = null };
-
-                var ex = Assert.Throws<ArgumentException>(() => service.SavePackageFileAsync(package, CreatePackageFileStream()).Wait());
-
-                Assert.True(ex.Message.StartsWith("The package is missing required data."));
-                Assert.Equal("package", ex.ParamName);
-            }
-
-            [Fact]
-            public async Task WillUseNormalizedRegularVersionIfNormalizedVersionMissing()
-            {
-                var fileStorageSvc = new Mock<IFileStorageService>();
-                var service = CreateService(fileStorageSvc: fileStorageSvc);
-                var packageRegistraion = new PackageRegistration { Id = "theId" };
-                var package = new Package { PackageRegistration = packageRegistraion, NormalizedVersion = null, Version = "01.01.01" };
-
-                fileStorageSvc.Setup(x => x.SaveFileAsync(It.IsAny<string>(), BuildFileName("theId", "1.1.1",Constants.NuGetPackageFileExtension, Constants.PackageFileSavePathTemplate), It.IsAny<Stream>(), It.Is<bool>(b => !b)))
-                    .Completes()
-                    .Verifiable();
-
-                await service.SavePackageFileAsync(package, CreatePackageFileStream());
-
-                fileStorageSvc.VerifyAll();
-            }
-
-            [Fact]
-            public async Task WillSaveTheFileViaTheFileStorageServiceUsingThePackagesFolder()
-            {
-                var fileStorageSvc = new Mock<IFileStorageService>();
-                var service = CreateService(fileStorageSvc: fileStorageSvc);
-                fileStorageSvc.Setup(x => x.SaveFileAsync(Constants.PackagesFolderName, It.IsAny<string>(), It.IsAny<Stream>(), It.Is<bool>(b => !b)))
-                    .Completes()
-                    .Verifiable();
-
-                await service.SavePackageFileAsync(CreatePackage(), CreatePackageFileStream());
-
-                fileStorageSvc.VerifyAll();
-            }
-
-            [Fact]
-            public async Task WillSaveTheFileViaTheFileStorageServiceUsingAFileNameWithIdAndNormalizedersion()
-            {
-                var fileStorageSvc = new Mock<IFileStorageService>();
-                var service = CreateService(fileStorageSvc: fileStorageSvc);
-                fileStorageSvc.Setup(x => x.SaveFileAsync(It.IsAny<string>(), BuildFileName("theId", "theNormalizedVersion", Constants.NuGetPackageFileExtension, Constants.PackageFileSavePathTemplate), It.IsAny<Stream>(), It.Is<bool>(b => !b)))
-                    .Completes()
-                    .Verifiable();
-
-                await service.SavePackageFileAsync(CreatePackage(), CreatePackageFileStream());
-
-                fileStorageSvc.VerifyAll();
-            }
-
-            [Fact]
-            public async Task WillSaveTheFileStreamViaTheFileStorageService()
-            {
-                var fileStorageSvc = new Mock<IFileStorageService>();
-                var fakeStream = new MemoryStream();
-                var service = CreateService(fileStorageSvc: fileStorageSvc);
-                fileStorageSvc.Setup(x => x.SaveFileAsync(It.IsAny<string>(), It.IsAny<string>(), fakeStream, It.Is<bool>(b => !b)))
-                    .Completes()
-                    .Verifiable();
-
-                await service.SavePackageFileAsync(CreatePackage(), fakeStream);
-
-                fileStorageSvc.VerifyAll();
-            }
-        }
-
+        
         public class TheStorePackageFileInBackupLocationAsyncMethod
         {
             private string packageHashForTests = "NzMzMS1QNENLNEczSDQ1SA==";
@@ -387,7 +266,7 @@ public async Task WillSaveTheFileViaTheFileStorageServiceUsingThePackagesFolder(
             {
                 var fileStorageSvc = new Mock<IFileStorageService>();
                 var service = CreateService(fileStorageSvc: fileStorageSvc);
-                fileStorageSvc.Setup(x => x.SaveFileAsync(Constants.PackageBackupsFolderName, It.IsAny<string>(), It.IsAny<Stream>(), It.Is<bool>(b => b)))
+                fileStorageSvc.Setup(x => x.SaveFileAsync(CoreConstants.PackageBackupsFolderName, It.IsAny<string>(), It.IsAny<Stream>(), It.Is<bool>(b => b)))
                     .Completes()
                     .Verifiable();
 
@@ -469,7 +348,7 @@ public async Task WhenValid_DeletesFromStorage(bool isPending = true)
                 await service.DeleteReadMeMdFileAsync(package, isPending: isPending);
 
                 // Assert.
-                fileServiceMock.Verify(fs => fs.DeleteFileAsync(Constants.PackageReadMesFolderName, $"{expectedFolder}/test/1.0.0.md"), Times.Once);
+                fileServiceMock.Verify(fs => fs.DeleteFileAsync(CoreConstants.PackageReadMesFolderName, $"{expectedFolder}/test/1.0.0.md"), Times.Once);
             }
         }
 
@@ -514,7 +393,7 @@ public async Task WhenValid_SavesReadMeFile()
                 await service.SavePendingReadMeMdFileAsync(package, "<p>Hello World!</p>");
 
                 // Assert.
-                fileServiceMock.Verify(f => f.SaveFileAsync(Constants.PackageReadMesFolderName, "pending/foo/1.0.0.md", It.IsAny<Stream>(), true),
+                fileServiceMock.Verify(f => f.SaveFileAsync(CoreConstants.PackageReadMesFolderName, "pending/foo/1.0.0.md", It.IsAny<Stream>(), true),
                     Times.Once);
             }
         }
@@ -561,7 +440,7 @@ public async Task WhenExists_ReturnsMarkdownStream(bool isPending)
                     // Assert.
                     Assert.Equal(expectedMd, actualMd);
 
-                    fileServiceMock.Verify(f => f.GetFileAsync(Constants.PackageReadMesFolderName, $"{expectedFolder}/foo/1.1.1.md"), Times.Once);
+                    fileServiceMock.Verify(f => f.GetFileAsync(CoreConstants.PackageReadMesFolderName, $"{expectedFolder}/foo/1.1.1.md"), Times.Once);
                 }
             }
 
@@ -594,7 +473,7 @@ public async Task WhenDoesNotExist_ReturnsNull(bool isPending)
                 // Assert
                 Assert.Null(result);
 
-                fileServiceMock.Verify(f => f.GetFileAsync(Constants.PackageReadMesFolderName, $"{expectedFolder}/foo/1.1.1.md"), Times.Once);
+                fileServiceMock.Verify(f => f.GetFileAsync(CoreConstants.PackageReadMesFolderName, $"{expectedFolder}/foo/1.1.1.md"), Times.Once);
             }
         }
 
@@ -618,7 +497,7 @@ private static string BuildBackupFileName(string id, string version, string hash
                 id,
                 version,
                 HttpServerUtility.UrlTokenEncode(hashBytes),
-                Constants.NuGetPackageFileExtension);
+                CoreConstants.NuGetPackageFileExtension);
         }
 
         static Package CreatePackage()
diff --git a/tests/NuGetGallery.Facts/Services/UploadFileServiceFacts.cs b/tests/NuGetGallery.Facts/Services/UploadFileServiceFacts.cs
index c33767d1cc..aad7109796 100644
--- a/tests/NuGetGallery.Facts/Services/UploadFileServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/UploadFileServiceFacts.cs
@@ -40,7 +40,7 @@ public void WillDeleteFromTheUploadToTheUploadsFolder()
 
                 service.DeleteUploadFileAsync(1);
 
-                fakeFileStorageService.Verify(x => x.DeleteFileAsync(Constants.UploadsFolderName, It.IsAny<string>()));
+                fakeFileStorageService.Verify(x => x.DeleteFileAsync(CoreConstants.UploadsFolderName, It.IsAny<string>()));
             }
 
             [Fact]
@@ -48,7 +48,7 @@ public void WillUseTheUserKeyInTheFileName()
             {
                 var fakeFileStorageService = new Mock<IFileStorageService>();
                 var service = CreateService(fakeFileStorageService: fakeFileStorageService);
-                var expectedFileName = String.Format(Constants.UploadFileNameTemplate, 1, Constants.NuGetPackageFileExtension);
+                var expectedFileName = String.Format(Constants.UploadFileNameTemplate, 1, CoreConstants.NuGetPackageFileExtension);
 
                 service.DeleteUploadFileAsync(1);
 
@@ -76,7 +76,7 @@ public void WillGetTheUploadFileFromTheUploadsFolder()
 
                 service.GetUploadFileAsync(1);
 
-                fakeFileStorageService.Verify(x => x.GetFileAsync(Constants.UploadsFolderName, It.IsAny<string>()));
+                fakeFileStorageService.Verify(x => x.GetFileAsync(CoreConstants.UploadsFolderName, It.IsAny<string>()));
             }
 
             [Fact]
@@ -84,7 +84,7 @@ public void WillUseTheUserKeyInTheFileName()
             {
                 var fakeFileStorageService = new Mock<IFileStorageService>();
                 var service = CreateService(fakeFileStorageService: fakeFileStorageService);
-                var expectedFileName = String.Format(Constants.UploadFileNameTemplate, 1, Constants.NuGetPackageFileExtension);
+                var expectedFileName = String.Format(Constants.UploadFileNameTemplate, 1, CoreConstants.NuGetPackageFileExtension);
 
                 service.GetUploadFileAsync(1);
 
@@ -94,10 +94,10 @@ public void WillUseTheUserKeyInTheFileName()
             [Fact]
             public async Task WillReturnTheUploadFileStream()
             {
-                var expectedFileName = String.Format(Constants.UploadFileNameTemplate, 1, Constants.NuGetPackageFileExtension);
+                var expectedFileName = String.Format(Constants.UploadFileNameTemplate, 1, CoreConstants.NuGetPackageFileExtension);
                 var fakeFileStorageService = new Mock<IFileStorageService>();
                 var fakeFileStream = new MemoryStream();
-                fakeFileStorageService.Setup(x => x.GetFileAsync(Constants.UploadsFolderName, expectedFileName))
+                fakeFileStorageService.Setup(x => x.GetFileAsync(CoreConstants.UploadsFolderName, expectedFileName))
                                       .Returns(Task.FromResult<Stream>(fakeFileStream));
                 var service = CreateService(fakeFileStorageService: fakeFileStorageService);
 
@@ -137,7 +137,7 @@ public void WillSaveTheUploadToTheUploadsFolder()
 
                 service.SaveUploadFileAsync(1, new MemoryStream());
 
-                fakeFileStorageService.Verify(x => x.SaveFileAsync(Constants.UploadsFolderName, It.IsAny<string>(), It.IsAny<Stream>(), It.Is<bool>(b => b)));
+                fakeFileStorageService.Verify(x => x.SaveFileAsync(CoreConstants.UploadsFolderName, It.IsAny<string>(), It.IsAny<Stream>(), It.Is<bool>(b => b)));
             }
 
             [Fact]
@@ -145,7 +145,7 @@ public void WillUseTheUserKeyInTheFileName()
             {
                 var fakeFileStorageService = new Mock<IFileStorageService>();
                 var service = CreateService(fakeFileStorageService: fakeFileStorageService);
-                var expectedFileName = String.Format(Constants.UploadFileNameTemplate, 1, Constants.NuGetPackageFileExtension);
+                var expectedFileName = String.Format(Constants.UploadFileNameTemplate, 1, CoreConstants.NuGetPackageFileExtension);
 
                 service.SaveUploadFileAsync(1, new MemoryStream());
 
diff --git a/tests/NuGetGallery.Facts/TestUtils/MockExtensions.cs b/tests/NuGetGallery.Facts/TestUtils/MockExtensions.cs
index 693b76bdaa..bb37f0f712 100644
--- a/tests/NuGetGallery.Facts/TestUtils/MockExtensions.cs
+++ b/tests/NuGetGallery.Facts/TestUtils/MockExtensions.cs
@@ -45,12 +45,6 @@ public static IReturnsResult<TMock> CompletesWithNull<TMock, TRet>(this IReturns
             return self.Returns(Task.FromResult((TRet)null));
         }
 
-        public static IReturnsResult<TMock> Completes<TMock>(this IReturns<TMock, Task> self)
-            where TMock : class
-        {
-            return self.Returns(Task.FromResult((object)null));
-        }
-
         public static IReturnsResult<TMock> CompletesWith<TMock, TRet>(this IReturns<TMock, Task<TRet>> self, TRet value)
             where TMock : class
         {
diff --git a/tests/NuGetGallery.Facts/TestUtils/TaskAssert.cs b/tests/NuGetGallery.Facts/TestUtils/TaskAssert.cs
deleted file mode 100644
index 558d0678c2..0000000000
--- a/tests/NuGetGallery.Facts/TestUtils/TaskAssert.cs
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright (c) .NET Foundation. All rights reserved.
-// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
-using System;
-using System.Threading.Tasks;
-using Xunit;
-
-namespace NuGetGallery
-{
-    static class TaskAssert
-    {
-        /// <summary>
-        /// Like XUnit Assert.Throws, but for actions which will throw an AggregateException that 
-        /// wraps some TException (because they use Task Parallel or async paradigm).
-        /// </summary>
-        /// <typeparam name="TException">The type of AggregateException's (single) inner exception</typeparam>
-        public static TException ThrowsAggregate<TException>(Action action) where TException : Exception
-        {
-            AggregateException exception = Assert.Throws<AggregateException>(() => action.Invoke());
-            Assert.Equal(1, exception.InnerExceptions.Count);
-            Assert.IsType<TException>(exception.InnerException);
-            return (TException)(exception.InnerException);
-        }
-
-        public static TException ThrowsAsync<TException>(Func<Task> testCode) where TException : Exception
-        {
-            return Assert.Throws<TException>(() => testCode().GetAwaiter().GetResult());
-        }
-    }
-}

From e46a585fbfa53f42333dffc4ad98b3cc7829eb6c Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Wed, 27 Sep 2017 17:09:08 -0700
Subject: [PATCH 18/25] Add APIs to upload, download, and delete a package from
 the validation container (#4761)

Progress on https://github.com/NuGet/NuGetGallery/issues/4646
---
 src/NuGetGallery.Core/CoreConstants.cs        |   1 +
 .../CloudBlobCoreFileStorageService.cs        |   2 +
 .../Services/CorePackageFileService.cs        |  46 ++++
 .../Services/ICorePackageFileService.cs       |  23 ++
 .../CloudBlobCoreFileStorageServiceFacts.cs   |  53 ++--
 .../Services/CorePackageFileServiceFacts.cs   | 253 +++++++++++++++++-
 6 files changed, 356 insertions(+), 22 deletions(-)

diff --git a/src/NuGetGallery.Core/CoreConstants.cs b/src/NuGetGallery.Core/CoreConstants.cs
index 60e2798294..e0f133bd12 100644
--- a/src/NuGetGallery.Core/CoreConstants.cs
+++ b/src/NuGetGallery.Core/CoreConstants.cs
@@ -21,5 +21,6 @@ public static class CoreConstants
         public const string PackageReadMesFolderName = "readmes";
         public const string PackagesFolderName = "packages";        
         public const string UploadsFolderName = "uploads";
+        public const string ValidationFolderName = "validation";
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery.Core/Services/CloudBlobCoreFileStorageService.cs b/src/NuGetGallery.Core/Services/CloudBlobCoreFileStorageService.cs
index cfb260f75c..ef90882d69 100644
--- a/src/NuGetGallery.Core/Services/CloudBlobCoreFileStorageService.cs
+++ b/src/NuGetGallery.Core/Services/CloudBlobCoreFileStorageService.cs
@@ -130,6 +130,7 @@ protected async Task<ICloudBlobContainer> GetContainer(string folderName)
                 case CoreConstants.ContentFolderName:
                 case CoreConstants.UploadsFolderName:
                 case CoreConstants.PackageReadMesFolderName:
+                case CoreConstants.ValidationFolderName:
                     creationTask = PrepareContainer(folderName, isPublic: false);
                     break;
 
@@ -199,6 +200,7 @@ private static string GetContentType(string folderName)
                 case CoreConstants.PackagesFolderName:
                 case CoreConstants.PackageBackupsFolderName:
                 case CoreConstants.UploadsFolderName:
+                case CoreConstants.ValidationFolderName:
                     return CoreConstants.PackageContentType;
 
                 case CoreConstants.DownloadsFolderName:
diff --git a/src/NuGetGallery.Core/Services/CorePackageFileService.cs b/src/NuGetGallery.Core/Services/CorePackageFileService.cs
index a909b71277..c67cca1004 100644
--- a/src/NuGetGallery.Core/Services/CorePackageFileService.cs
+++ b/src/NuGetGallery.Core/Services/CorePackageFileService.cs
@@ -34,6 +34,52 @@ public Task<Stream> DownloadPackageFileAsync(Package package)
             return _fileStorageService.GetFileAsync(CoreConstants.PackagesFolderName, fileName);
         }
 
+        public Task SaveValidationPackageFileAsync(Package package, Stream packageFile)
+        {
+            if (packageFile == null)
+            {
+                throw new ArgumentNullException(nameof(packageFile));
+            }
+
+            var fileName = BuildFileName(
+                package,
+                CoreConstants.PackageFileSavePathTemplate,
+                CoreConstants.NuGetPackageFileExtension);
+
+            return _fileStorageService.SaveFileAsync(
+                CoreConstants.ValidationFolderName,
+                fileName,
+                packageFile,
+                overwrite: false);
+        }
+
+        public Task<Stream> DownloadValidationPackageFileAsync(Package package)
+        {
+            var fileName = BuildFileName(
+                package,
+                CoreConstants.PackageFileSavePathTemplate,
+                CoreConstants.NuGetPackageFileExtension);
+
+            return _fileStorageService.GetFileAsync(CoreConstants.ValidationFolderName, fileName);
+        }
+
+        public Task DeleteValidationPackageFileAsync(string id, string version)
+        {
+            if (version == null)
+            {
+                throw new ArgumentNullException(nameof(version));
+            }
+
+            var normalizedVersion = NuGetVersionFormatter.Normalize(version);
+            var fileName = BuildFileName(
+                id,
+                normalizedVersion,
+                CoreConstants.PackageFileSavePathTemplate,
+                CoreConstants.NuGetPackageFileExtension);
+            
+            return _fileStorageService.DeleteFileAsync(CoreConstants.ValidationFolderName, fileName);
+        }
+
         protected static string BuildFileName(Package package, string format, string extension)
         {
             if (package == null)
diff --git a/src/NuGetGallery.Core/Services/ICorePackageFileService.cs b/src/NuGetGallery.Core/Services/ICorePackageFileService.cs
index e0de04bb0c..1f9bc309c7 100644
--- a/src/NuGetGallery.Core/Services/ICorePackageFileService.cs
+++ b/src/NuGetGallery.Core/Services/ICorePackageFileService.cs
@@ -17,5 +17,28 @@ public interface ICorePackageFileService
         /// Downloads the package from the file storage and reads it into a stream.
         /// </summary>
         Task<Stream> DownloadPackageFileAsync(Package package);
+
+        /// <summary>
+        /// Saves the contents of the package to the private container for packages that are being validated. If the
+        /// file already exists, an exception will be thrown.
+        /// </summary>
+        /// <param name="package">The package metadata.</param>
+        /// <param name="packageFile">The stream containing the package itself (the .nupkg).</param>
+        Task SaveValidationPackageFileAsync(Package package, Stream packageFile);
+
+        /// <summary>
+        /// Downloads the validating package from the file storage and reads it into a stream. If the file does not
+        /// exist, an exception will be thrown.
+        /// </summary>
+        /// <param name="package">The package metadata.</param>
+        Task<Stream> DownloadValidationPackageFileAsync(Package package);
+
+        /// <summary>
+        /// Deletes the validating package from the file storage. If the file does not exist this method will not throw
+        /// any exception.
+        /// </summary>
+        /// <param name="id">The package ID. This value is case-insensitive.</param>
+        /// <param name="version">The package version. This value is case-insensitive and need not be normalized.</param>
+        Task DeleteValidationPackageFileAsync(string id, string version);
     }
 }
\ No newline at end of file
diff --git a/tests/NuGetGallery.Core.Facts/Services/CloudBlobCoreFileStorageServiceFacts.cs b/tests/NuGetGallery.Core.Facts/Services/CloudBlobCoreFileStorageServiceFacts.cs
index 250daee105..633dbe3407 100644
--- a/tests/NuGetGallery.Core.Facts/Services/CloudBlobCoreFileStorageServiceFacts.cs
+++ b/tests/NuGetGallery.Core.Facts/Services/CloudBlobCoreFileStorageServiceFacts.cs
@@ -32,24 +32,47 @@ private static CloudBlobCoreFileStorageService CreateService(
 
         private class FolderNamesDataAttribute : DataAttribute
         {
-            public FolderNamesDataAttribute(bool includePermissions = false)
+            public FolderNamesDataAttribute(bool includePermissions = false, bool includeContentTypes = false)
             {
                 IncludePermissions = includePermissions;
+                IncludeContentTypes = includeContentTypes;
             }
 
-            private bool IncludePermissions { get; set; }
+            private bool IncludePermissions { get; }
+
+            private bool IncludeContentTypes { get; }
 
             public override IEnumerable<object[]> GetData(MethodInfo testMethod)
             {
                 var folderNames = new List<object[]>
-                    {
-                        new object[] { CoreConstants.PackagesFolderName, true },
-                        new object[] { CoreConstants.UploadsFolderName, false }
-                    };
-
-                if (!IncludePermissions)
                 {
-                    folderNames = folderNames.Select(fn => new[] { fn.ElementAt(0) }).ToList();
+                    new object[] { CoreConstants.ContentFolderName, false, null, },
+                    new object[] { CoreConstants.DownloadsFolderName, true, CoreConstants.OctetStreamContentType },
+                    new object[] { CoreConstants.PackageBackupsFolderName, true, CoreConstants.PackageContentType },
+                    new object[] { CoreConstants.PackageReadMesFolderName, false, CoreConstants.TextContentType },
+                    new object[] { CoreConstants.PackagesFolderName, true, CoreConstants.PackageContentType },
+                    new object[] { CoreConstants.UploadsFolderName, false, CoreConstants.PackageContentType },
+                    new object[] { CoreConstants.ValidationFolderName, false, CoreConstants.PackageContentType },
+                };
+
+                if (!IncludePermissions && !IncludeContentTypes)
+                {
+                    folderNames = folderNames
+                        .Select(fn => new[] { fn.ElementAt(0) })
+                        .ToList();
+                }
+                else if (IncludePermissions && !IncludeContentTypes)
+                {
+                    folderNames = folderNames
+                        .Select(fn => new[] { fn[0], fn[1] })
+                        .ToList();
+                }
+                else if (!IncludePermissions && IncludeContentTypes)
+                {
+                    folderNames = folderNames
+                        .Where(fn => fn[2] != null)
+                        .Select(fn => new[] { fn[0], fn[2] })
+                        .ToList();
                 }
 
                 return folderNames;
@@ -343,8 +366,8 @@ public async Task WillSetTheStreamPositionToZero(string folderName)
         public class TheSaveFileMethod
         {
             [Theory]
-            [FolderNamesData]
-            public async Task WillGetTheBlobFromTheCorrectFolderContainer(string folderName)
+            [FolderNamesData(includeContentTypes: true)]
+            public async Task WillGetTheBlobFromTheCorrectFolderContainer(string folderName, string contentType)
             {
                 var fakeBlobClient = new Mock<ICloudBlobClient>();
                 var fakeBlobContainer = new Mock<ICloudBlobContainer>();
@@ -376,7 +399,7 @@ public async Task WillGetTheBlobFromTheCorrectFolderContainer(string folderName)
                 var service = CreateService(fakeBlobClient: fakeBlobClient);
 
                 await service.SaveFileAsync(folderName, "theFileName", new MemoryStream());
-
+                
                 fakeBlobContainer.Verify(x => x.GetBlobReference("theFileName"));
             }
 
@@ -450,8 +473,8 @@ public async Task WillUploadThePackageFileToTheBlob()
             }
 
             [Theory]
-            [FolderNamesData]
-            public async Task WillSetTheBlobContentType(string folderName)
+            [FolderNamesData(includeContentTypes: true)]
+            public async Task WillSetTheBlobContentType(string folderName, string contentType)
             {
                 var fakeBlobClient = new Mock<ICloudBlobClient>();
                 var fakeBlobContainer = new Mock<ICloudBlobContainer>();
@@ -483,7 +506,7 @@ public async Task WillSetTheBlobContentType(string folderName)
 
                 await service.SaveFileAsync(folderName, "theFileName", new MemoryStream());
 
-                Assert.Equal(CoreConstants.PackageContentType, fakeBlob.Object.Properties.ContentType);
+                Assert.Equal(contentType, fakeBlob.Object.Properties.ContentType);
                 fakeBlob.Verify(x => x.SetPropertiesAsync());
             }
         }
diff --git a/tests/NuGetGallery.Core.Facts/Services/CorePackageFileServiceFacts.cs b/tests/NuGetGallery.Core.Facts/Services/CorePackageFileServiceFacts.cs
index bb643fcf6f..bb50e5c147 100644
--- a/tests/NuGetGallery.Core.Facts/Services/CorePackageFileServiceFacts.cs
+++ b/tests/NuGetGallery.Core.Facts/Services/CorePackageFileServiceFacts.cs
@@ -12,6 +12,14 @@ namespace NuGetGallery
 {
     public class CorePackageFileServiceFacts
     {
+        private const string ValidationFolderName = "validation";
+        private const string Id = "NuGet.Versioning";
+        private const string Version = "4.3.0.0-BETA+1";
+        private const string NormalizedVersion = "4.3.0-BETA";
+        private const string LowercaseId = "nuget.versioning";
+        private const string LowercaseVersion = "4.3.0-beta";
+        private static readonly string ValidationFileName = $"{LowercaseId}.{LowercaseVersion}.nupkg";
+
         public class TheSavePackageFileMethod
         {
             [Fact]
@@ -76,7 +84,7 @@ public void WillThrowIfPackageIsMissingNormalizedVersionAndVersion()
             public async Task WillUseNormalizedRegularVersionIfNormalizedVersionMissing()
             {
                 var fileStorageSvc = new Mock<ICoreFileStorageService>();
-                var service = CreateService(fileStorageSvc: fileStorageSvc);
+                var service = CreateService(fileStorageService: fileStorageSvc);
                 var packageRegistraion = new PackageRegistration { Id = "theId" };
                 var package = new Package { PackageRegistration = packageRegistraion, NormalizedVersion = null, Version = "01.01.01" };
 
@@ -93,7 +101,7 @@ public async Task WillUseNormalizedRegularVersionIfNormalizedVersionMissing()
             public async Task WillSaveTheFileViaTheFileStorageServiceUsingThePackagesFolder()
             {
                 var fileStorageSvc = new Mock<ICoreFileStorageService>();
-                var service = CreateService(fileStorageSvc: fileStorageSvc);
+                var service = CreateService(fileStorageService: fileStorageSvc);
                 fileStorageSvc.Setup(x => x.SaveFileAsync(CoreConstants.PackagesFolderName, It.IsAny<string>(), It.IsAny<Stream>(), It.Is<bool>(b => !b)))
                     .Completes()
                     .Verifiable();
@@ -107,7 +115,7 @@ public async Task WillSaveTheFileViaTheFileStorageServiceUsingThePackagesFolder(
             public async Task WillSaveTheFileViaTheFileStorageServiceUsingAFileNameWithIdAndNormalizedersion()
             {
                 var fileStorageSvc = new Mock<ICoreFileStorageService>();
-                var service = CreateService(fileStorageSvc: fileStorageSvc);
+                var service = CreateService(fileStorageService: fileStorageSvc);
                 fileStorageSvc.Setup(x => x.SaveFileAsync(It.IsAny<string>(), BuildFileName("theId", "theNormalizedVersion", CoreConstants.NuGetPackageFileExtension, CoreConstants.PackageFileSavePathTemplate), It.IsAny<Stream>(), It.Is<bool>(b => !b)))
                     .Completes()
                     .Verifiable();
@@ -122,7 +130,7 @@ public async Task WillSaveTheFileStreamViaTheFileStorageService()
             {
                 var fileStorageSvc = new Mock<ICoreFileStorageService>();
                 var fakeStream = new MemoryStream();
-                var service = CreateService(fileStorageSvc: fileStorageSvc);
+                var service = CreateService(fileStorageService: fileStorageSvc);
                 fileStorageSvc.Setup(x => x.SaveFileAsync(It.IsAny<string>(), It.IsAny<string>(), fakeStream, It.Is<bool>(b => !b)))
                     .Completes()
                     .Verifiable();
@@ -133,6 +141,213 @@ public async Task WillSaveTheFileStreamViaTheFileStorageService()
             }
         }
         
+        public class TheSaveValidationPackageFileMethod : FactsBase
+        {
+            [Fact]
+            public async Task WillThrowIfPackageIsNull()
+            {
+                _package = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentNullException>(
+                    () => _service.SaveValidationPackageFileAsync(_package, _packageFile));
+
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillThrowIfPackageFileIsNull()
+            {
+                _packageFile = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentNullException>(
+                    () => _service.SaveValidationPackageFileAsync(_package, _packageFile));
+
+                Assert.Equal("packageFile", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillThrowIfPackageIsMissingPackageRegistration()
+            {
+                _package.PackageRegistration = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentException>(
+                    () => _service.SaveValidationPackageFileAsync(_package, _packageFile));
+
+                Assert.StartsWith("The package is missing required data.", ex.Message);
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillThrowIfPackageIsMissingPackageRegistrationId()
+            {
+                _package.PackageRegistration.Id = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentException>(
+                    () => _service.SaveValidationPackageFileAsync(_package, _packageFile));
+
+                Assert.StartsWith("The package is missing required data.", ex.Message);
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillThrowIfPackageIsMissingNormalizedVersionAndVersion()
+            {
+                _package.Version = null;
+                _package.NormalizedVersion = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentException>(
+                    () => _service.SaveValidationPackageFileAsync(_package, _packageFile));
+
+                Assert.StartsWith("The package is missing required data.", ex.Message);
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillUseNormalizedRegularVersionIfNormalizedVersionMissing()
+            {
+                _package.NormalizedVersion = null;
+
+                await _service.SaveValidationPackageFileAsync(_package, _packageFile);
+
+                _fileStorageService.Verify(
+                    x => x.SaveFileAsync(ValidationFolderName, ValidationFileName, _packageFile, false),
+                    Times.Once);
+                _fileStorageService.Verify(
+                    x => x.SaveFileAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<Stream>(), It.IsAny<bool>()),
+                    Times.Once);
+            }
+
+            [Fact]
+            public async Task WillSaveTheFileViaTheFileStorageService()
+            {
+                await _service.SaveValidationPackageFileAsync(_package, _packageFile);
+
+                _fileStorageService.Verify(
+                    x => x.SaveFileAsync(ValidationFolderName, ValidationFileName, _packageFile, false),
+                    Times.Once);
+                _fileStorageService.Verify(
+                    x => x.SaveFileAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<Stream>(), It.IsAny<bool>()),
+                    Times.Once);
+            }
+        }
+
+        public class TheDownloadValidationPackageFileMethod : FactsBase
+        {
+            [Fact]
+            public async Task WillThrowIfPackageIsNull()
+            {
+                _package = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentNullException>(
+                    () => _service.DownloadValidationPackageFileAsync(_package));
+
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillThrowIfPackageIsMissingPackageRegistration()
+            {
+                _package.PackageRegistration = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentException>(
+                    () => _service.DownloadValidationPackageFileAsync(_package));
+
+                Assert.StartsWith("The package is missing required data.", ex.Message);
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillThrowIfPackageIsMissingPackageRegistrationId()
+            {
+                _package.PackageRegistration.Id = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentException>(
+                    () => _service.DownloadValidationPackageFileAsync(_package));
+
+                Assert.StartsWith("The package is missing required data.", ex.Message);
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillThrowIfPackageIsMissingNormalizedVersionAndVersion()
+            {
+                _package.Version = null;
+                _package.NormalizedVersion = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentException>(
+                    () => _service.DownloadValidationPackageFileAsync(_package));
+
+                Assert.StartsWith("The package is missing required data.", ex.Message);
+                Assert.Equal("package", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillUseNormalizedRegularVersionIfNormalizedVersionMissing()
+            {
+                _package.NormalizedVersion = null;
+
+                await _service.DownloadValidationPackageFileAsync(_package);
+
+                _fileStorageService.Verify(
+                    x => x.GetFileAsync(ValidationFolderName, ValidationFileName),
+                    Times.Once);
+                _fileStorageService.Verify(
+                    x => x.GetFileAsync(It.IsAny<string>(), It.IsAny<string>()),
+                    Times.Once);
+            }
+
+            [Fact]
+            public async Task WillDownloadTheFileViaTheFileStorageService()
+            {
+                await _service.DownloadValidationPackageFileAsync(_package);
+
+                _fileStorageService.Verify(
+                    x => x.GetFileAsync(ValidationFolderName, ValidationFileName),
+                    Times.Once);
+                _fileStorageService.Verify(
+                    x => x.GetFileAsync(It.IsAny<string>(), It.IsAny<string>()),
+                    Times.Once);
+            }
+        }
+
+        public class TheDeletePackageFileMethod : FactsBase
+        {
+            [Fact]
+            public async Task WillThrowIfIdIsNull()
+            {
+                string id = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentNullException>(
+                    () => _service.DeleteValidationPackageFileAsync(id, Version));
+
+                Assert.Equal("id", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillThrowIfVersionIsNull()
+            {
+                string version = null;
+
+                var ex = await Assert.ThrowsAsync<ArgumentNullException>(
+                    () => _service.DeleteValidationPackageFileAsync(Id, version));
+
+                Assert.Equal("version", ex.ParamName);
+            }
+
+            [Fact]
+            public async Task WillDeleteTheFileViaTheFileStorageService()
+            {
+                await _service.DeleteValidationPackageFileAsync(Id, Version);
+
+                _fileStorageService.Verify(
+                    x => x.DeleteFileAsync(ValidationFolderName, ValidationFileName),
+                    Times.Once);
+                _fileStorageService.Verify(
+                    x => x.DeleteFileAsync(It.IsAny<string>(), It.IsAny<string>()),
+                    Times.Once);
+            }
+        }
+
         static string BuildFileName(
             string id,
             string version, string extension, string path)
@@ -157,12 +372,36 @@ static MemoryStream CreatePackageFileStream()
             return new MemoryStream(new byte[] { 0, 0, 1, 0, 1, 0, 1, 0 }, 0, 8, true, true);
         }
 
-        static CorePackageFileService CreateService(Mock<ICoreFileStorageService> fileStorageSvc = null)
+        static CorePackageFileService CreateService(Mock<ICoreFileStorageService> fileStorageService = null)
         {
-            fileStorageSvc = fileStorageSvc ?? new Mock<ICoreFileStorageService>();
+            fileStorageService = fileStorageService ?? new Mock<ICoreFileStorageService>();
 
             return new CorePackageFileService(
-                fileStorageSvc.Object);
+                fileStorageService.Object);
+        }
+
+        public abstract class FactsBase
+        {
+            protected readonly Mock<ICoreFileStorageService> _fileStorageService;
+            protected readonly CorePackageFileService _service;
+            protected Package _package;
+            protected Stream _packageFile;
+
+            public FactsBase()
+            {
+                _fileStorageService = new Mock<ICoreFileStorageService>();
+                _service = CreateService(fileStorageService: _fileStorageService);
+                _package = new Package
+                {
+                    PackageRegistration = new PackageRegistration
+                    {
+                        Id = Id,
+                    },
+                    Version = Version,
+                    NormalizedVersion = NormalizedVersion,
+                };
+                _packageFile = Stream.Null;
+            }
         }
     }
 }

From d6b55e7f15f2d7963f382d4e9719ce6ede5eed1f Mon Sep 17 00:00:00 2001
From: Xavier Decoster <xavierdecoster@users.noreply.github.com>
Date: Thu, 28 Sep 2017 18:27:41 +0200
Subject: [PATCH 19/25] Do not rewrite return URL for MSA/AAD auth (#4765)

* Do not rewrite return URL for MSA/AAD auth

* Fix unit test
---
 src/NuGetGallery/UrlExtensions.cs                     | 11 ++++++-----
 .../Controllers/AuthenticationControllerFacts.cs      |  8 ++------
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/src/NuGetGallery/UrlExtensions.cs b/src/NuGetGallery/UrlExtensions.cs
index 2f492889c6..c61559973e 100644
--- a/src/NuGetGallery/UrlExtensions.cs
+++ b/src/NuGetGallery/UrlExtensions.cs
@@ -583,7 +583,8 @@ public static string LinkExternalAccount(this UrlHelper url, string returnUrl, b
                 routeValues: new RouteValueDictionary
                 {
                     { "ReturnUrl", returnUrl }
-                });
+                },
+                interceptReturnUrl: false);
         }
 
         public static string ManageMyApiKeys(this UrlHelper url, bool relativeUrl = true)
@@ -835,14 +836,14 @@ private static string GetActionLink(
             string actionName,
             string controllerName,
             bool relativeUrl,
-            RouteValueDictionary routeValues = null
+            RouteValueDictionary routeValues = null,
+            bool interceptReturnUrl = true
             )
         {
             var protocol = GetProtocol(url);
             var hostName = GetConfiguredSiteHostName();
-
-
-            if (routeValues != null && routeValues.ContainsKey("ReturnUrl"))
+            
+            if (interceptReturnUrl && routeValues != null && routeValues.ContainsKey("ReturnUrl"))
             {
                 routeValues["ReturnUrl"] = GetAbsoluteReturnUrl(
                     routeValues["ReturnUrl"]?.ToString(),
diff --git a/tests/NuGetGallery.Facts/Controllers/AuthenticationControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/AuthenticationControllerFacts.cs
index 1feffd1b4c..7a62864a4e 100644
--- a/tests/NuGetGallery.Facts/Controllers/AuthenticationControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/AuthenticationControllerFacts.cs
@@ -728,16 +728,12 @@ public void WillChallengeTheUserUsingTheGivenProviderAndReturnUrl()
                 const string returnUrl = "/theReturnUrl";
                 EnableAllAuthenticators(Get<AuthenticationService>());
                 var controller = GetController<AuthenticationController>();
-                var absoluteReturnUrl = UrlExtensions.GetAbsoluteReturnUrl(
-                    returnUrl,
-                    "https",
-                    new Uri(GetConfigurationService().GetSiteRoot(useHttps: true)).Host);
-
+                
                 // Act
                 var result = controller.ChallengeAuthentication(returnUrl, "MicrosoftAccount");
 
                 // Assert
-                ResultAssert.IsChallengeResult(result, "MicrosoftAccount", "/users/account/authenticate/return?ReturnUrl=" + HttpUtility.UrlEncode(absoluteReturnUrl));
+                ResultAssert.IsChallengeResult(result, "MicrosoftAccount", "/users/account/authenticate/return?ReturnUrl=" + HttpUtility.UrlEncode(returnUrl));
             }
         }
 

From ab6f409dc50bfb7aae0fbf0446c49e62d8371c40 Mon Sep 17 00:00:00 2001
From: Svetlana Kofman <skofman@microsoft.com>
Date: Thu, 28 Sep 2017 13:27:17 -0700
Subject: [PATCH 20/25] Add text to API Keys page (#4768)

* Add text to API Keys page

* add paragraph
---
 src/NuGetGallery/Views/Users/ApiKeys.cshtml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/NuGetGallery/Views/Users/ApiKeys.cshtml b/src/NuGetGallery/Views/Users/ApiKeys.cshtml
index e75769bfed..175855ad8b 100644
--- a/src/NuGetGallery/Views/Users/ApiKeys.cshtml
+++ b/src/NuGetGallery/Views/Users/ApiKeys.cshtml
@@ -52,6 +52,10 @@
                 <p>
                     <strong>Always keep your API keys a secret!</strong> If one of your keys is accidentally revealed,
                     you can always generate a new one at any time. You can also remove existing API keys if necessary.
+                    <br />
+                    <p>
+                        <strong>Note:</strong> We recommend using NuGet.exe v4.1.0 or above to push packages.
+                    </p>
                 </p>
 
                 <div data-bind="template: 'error-container'"></div>

From 2db880767cf7e75741e68bdabe19dbf13156b1fd Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Thu, 28 Sep 2017 13:37:59 -0700
Subject: [PATCH 21/25] Move package commit logic to IPackageUploadService
 (#4764)

Progress on https://github.com/NuGet/NuGetGallery/issues/4646
---
 src/NuGetGallery/Controllers/ApiController.cs |  34 +-
 .../Controllers/PackagesController.cs         |  33 +-
 .../Services/IPackageUploadService.cs         |  32 +-
 .../Services/PackageUploadService.cs          |  50 ++-
 .../Controllers/ApiControllerFacts.cs         | 249 +++++++-------
 .../Controllers/PackagesControllerFacts.cs    | 325 +++++++++---------
 .../Services/PackageUploadServiceFacts.cs     | 120 +++++++
 7 files changed, 506 insertions(+), 337 deletions(-)

diff --git a/src/NuGetGallery/Controllers/ApiController.cs b/src/NuGetGallery/Controllers/ApiController.cs
index 30388ddb0b..14e67ee323 100644
--- a/src/NuGetGallery/Controllers/ApiController.cs
+++ b/src/NuGetGallery/Controllers/ApiController.cs
@@ -486,31 +486,25 @@ await AuditingService.SaveAuditRecordAsync(
 
                         await AutoCuratePackage.ExecuteAsync(package, packageToPush, commitChanges: false);
 
+                        PackageCommitResult commitResult;
                         using (Stream uploadStream = packageStream)
                         {
                             uploadStream.Position = 0;
-
-                            try
-                            {
-                                await PackageFileService.SavePackageFileAsync(package, uploadStream.AsSeekableStream());
-                            }
-                            catch (InvalidOperationException ex)
-                            {
-                                ex.Log();
-
-                                return new HttpStatusCodeWithBodyResult(HttpStatusCode.Conflict, Strings.UploadPackage_IdVersionConflict);
-                            }
+                            commitResult = await PackageUploadService.CommitPackageAsync(
+                                package,
+                                uploadStream.AsSeekableStream());
                         }
-
-                        try
-                        {
-                            await EntitiesContext.SaveChangesAsync();
-                        }
-                        catch
+                            
+                        switch (commitResult)
                         {
-                            // If saving to the DB fails for any reason, we need to delete the package we just saved.
-                            await PackageFileService.DeletePackageFileAsync(nuspec.GetId(), nuspec.GetVersion().ToNormalizedString());
-                            throw;
+                            case PackageCommitResult.Success:
+                                break;
+                            case PackageCommitResult.Conflict:
+                                return new HttpStatusCodeWithBodyResult(
+                                    HttpStatusCode.Conflict,
+                                    Strings.UploadPackage_IdVersionConflict);
+                            default:
+                                throw new NotImplementedException($"The package commit result {commitResult} is not supported.");
                         }
 
                         IndexingService.UpdatePackage(package);
diff --git a/src/NuGetGallery/Controllers/PackagesController.cs b/src/NuGetGallery/Controllers/PackagesController.cs
index 34c351bb1c..59bf0d6e64 100644
--- a/src/NuGetGallery/Controllers/PackagesController.cs
+++ b/src/NuGetGallery/Controllers/PackagesController.cs
@@ -1494,30 +1494,21 @@ public virtual async Task<JsonResult> VerifyPackage(VerifyPackageRequest formDat
 
                 await _autoCuratedPackageCmd.ExecuteAsync(package, nugetPackage, commitChanges: false);
 
-                // save package to blob storage
+                // Commit the package to storage and to the database.
                 uploadFile.Position = 0;
-                try
-                {
-                    await _packageFileService.SavePackageFileAsync(package, uploadFile.AsSeekableStream());
-                }
-                catch (InvalidOperationException ex)
-                {
-                    ex.Log();
-                    TempData["Message"] = Strings.UploadPackage_IdVersionConflict;
-                    
-                    return Json(409, new [] { Strings.UploadPackage_IdVersionConflict });
-                }
+                var commitResult = await _packageUploadService.CommitPackageAsync(
+                    package,
+                    uploadFile.AsSeekableStream());
 
-                try
-                {
-                    // commit all changes to database as an atomic transaction
-                    await _entitiesContext.SaveChangesAsync();
-                }
-                catch
+                switch (commitResult)
                 {
-                    // If saving to the DB fails for any reason we need to delete the package we just saved.
-                    await _packageFileService.DeletePackageFileAsync(packageMetadata.Id, packageMetadata.Version.ToNormalizedString());
-                    throw;
+                    case PackageCommitResult.Success:
+                        break;
+                    case PackageCommitResult.Conflict:
+                        TempData["Message"] = Strings.UploadPackage_IdVersionConflict;
+                        return Json(409, new[] { Strings.UploadPackage_IdVersionConflict });
+                    default:
+                        throw new NotImplementedException($"The package commit result {commitResult} is not supported.");
                 }
 
                 // tell Lucene to update index for the new package
diff --git a/src/NuGetGallery/Services/IPackageUploadService.cs b/src/NuGetGallery/Services/IPackageUploadService.cs
index 708139093e..dbe4f6f485 100644
--- a/src/NuGetGallery/Services/IPackageUploadService.cs
+++ b/src/NuGetGallery/Services/IPackageUploadService.cs
@@ -1,14 +1,44 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
+using System.IO;
 using System.Threading.Tasks;
 using NuGet.Packaging;
 using NuGetGallery.Packaging;
 
 namespace NuGetGallery
 {
+    /// <summary>
+    /// Non-exceptional results of calling <see cref="IPackageUploadService.CommitPackageAsync(Package, Stream)"/>.
+    /// </summary>
+    public enum PackageCommitResult
+    {
+        /// <summary>
+        /// The package was successfully committed to the package file storage and to the database.
+        /// </summary>
+        Success,
+
+        /// <summary>
+        /// The package file conflicts with an existing package file. The package was not committed to the database.
+        /// </summary>
+        Conflict,
+    }
+
     public interface IPackageUploadService
     {
-        Task<Package> GeneratePackageAsync(string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user);
+        Task<Package> GeneratePackageAsync(
+            string id,
+            PackageArchiveReader nugetPackage,
+            PackageStreamMetadata packageStreamMetadata,
+            User user);
+
+        /// <summary>
+        /// Commit the provided package metadata and stream to the package file storage and to the database. This
+        /// method commits the shared <see cref="IEntitiesContext"/>. This method can throw exceptions in exceptional
+        /// cases (such as database failures). This method does not dispose the provided stream but does read it.
+        /// </summary>
+        /// <param name="package">The package metadata. This is assumed to already be added to the context.</param>
+        /// <param name="packageFile">The seekable stream containing the package content (.nupkg).</param>
+        Task<PackageCommitResult> CommitPackageAsync(Package package, Stream packageFile);
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/Services/PackageUploadService.cs b/src/NuGetGallery/Services/PackageUploadService.cs
index adce79f87a..2546fc736d 100644
--- a/src/NuGetGallery/Services/PackageUploadService.cs
+++ b/src/NuGetGallery/Services/PackageUploadService.cs
@@ -1,7 +1,9 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
+using System;
 using System.Collections.Generic;
+using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
 using NuGet.Packaging;
@@ -12,20 +14,30 @@ namespace NuGetGallery
     public class PackageUploadService : IPackageUploadService
     {
         private readonly IPackageService _packageService;
+        private readonly IPackageFileService _packageFileService;
+        private readonly IEntitiesContext _entitiesContext;
         private readonly IReservedNamespaceService _reservedNamespaceService;
         private readonly IValidationService _validationService;
 
         public PackageUploadService(
             IPackageService packageService,
+            IPackageFileService packageFileService,
+            IEntitiesContext entitiesContext,
             IReservedNamespaceService reservedNamespaceService,
             IValidationService validationService)
         {
-            _packageService = packageService;
-            _reservedNamespaceService = reservedNamespaceService;
-            _validationService = validationService;
+            _packageService = packageService ?? throw new ArgumentNullException(nameof(packageService));
+            _packageFileService = packageFileService ?? throw new ArgumentNullException(nameof(packageFileService));
+            _entitiesContext = entitiesContext ?? throw new ArgumentNullException(nameof(entitiesContext));
+            _reservedNamespaceService = reservedNamespaceService ?? throw new ArgumentNullException(nameof(reservedNamespaceService));
+            _validationService = validationService ?? throw new ArgumentNullException(nameof(validationService));
         }
 
-        public async Task<Package> GeneratePackageAsync(string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user)
+        public async Task<Package> GeneratePackageAsync(
+            string id,
+            PackageArchiveReader nugetPackage,
+            PackageStreamMetadata packageStreamMetadata,
+            User user)
         {
             var isPushAllowed = _reservedNamespaceService.IsPushAllowed(id, user, out IReadOnlyCollection<ReservedNamespace> userOwnedNamespaces);
             var shouldMarkIdVerified = isPushAllowed && userOwnedNamespaces != null && userOwnedNamespaces.Any();
@@ -51,5 +63,35 @@ public async Task<Package> GeneratePackageAsync(string id, PackageArchiveReader
 
             return package;
         }
+
+        public async Task<PackageCommitResult> CommitPackageAsync(Package package, Stream packageFile)
+        {
+            try
+            {
+                await _packageFileService.SavePackageFileAsync(package, packageFile);
+            }
+            catch (InvalidOperationException ex)
+            {
+                ex.Log();
+                return PackageCommitResult.Conflict;
+            }
+
+            try
+            {
+                // commit all changes to database as an atomic transaction
+                await _entitiesContext.SaveChangesAsync();
+            }
+            catch
+            {
+                // If saving to the DB fails for any reason we need to delete the package we just saved.
+                await _packageFileService.DeletePackageFileAsync(
+                    package.PackageRegistration.Id,
+                    package.Version);
+
+                throw;
+            }
+
+            return PackageCommitResult.Success;
+        }
     }
 }
\ No newline at end of file
diff --git a/tests/NuGetGallery.Facts/Controllers/ApiControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/ApiControllerFacts.cs
index 6c9a683373..155ce94532 100644
--- a/tests/NuGetGallery.Facts/Controllers/ApiControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/ApiControllerFacts.cs
@@ -7,6 +7,7 @@
 using System.Data;
 using System.Globalization;
 using System.IO;
+using System.Linq;
 using System.Net;
 using System.Threading.Tasks;
 using System.Web;
@@ -17,12 +18,12 @@
 using NuGet.Packaging;
 using NuGetGallery.Auditing;
 using NuGetGallery.Authentication;
+using NuGetGallery.Configuration;
 using NuGetGallery.Framework;
 using NuGetGallery.Infrastructure.Authentication;
 using NuGetGallery.Packaging;
 using NuGetGallery.Security;
 using Xunit;
-using NuGetGallery.Configuration;
 
 namespace NuGetGallery
 {
@@ -82,19 +83,6 @@ public TestableApiController(
             MockTelemetryService = new Mock<ITelemetryService>();
             TelemetryService = MockTelemetryService.Object;
 
-            MockPackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>())).
-                Returns((PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user, bool isVerified) =>
-                {
-                    var packageMetadata = PackageMetadata.FromNuspecReader(nugetPackage.GetNuspecReader());
-
-                    var package = new Package();
-                    package.PackageRegistration = new PackageRegistration { Id = packageMetadata.Id, IsVerified = isVerified };
-                    package.Version = packageMetadata.Version.ToString();
-                    package.SemVerLevelKey = SemVerLevelKey.ForPackage(packageMetadata.Version, packageMetadata.GetDependencyGroups().AsPackageDependencyEnumerable());
-
-                    return Task.FromResult(package);
-                });
-
             MockSecurityPolicyService.Setup(s => s.EvaluateAsync(It.IsAny<SecurityPolicyAction>(), It.IsAny<HttpContextBase>()))
                 .Returns(Task.FromResult(SecurityPolicyResult.SuccessResult));
 
@@ -105,7 +93,14 @@ public TestableApiController(
 
             MockPackageUploadService.Setup(x => x.GeneratePackageAsync(It.IsAny<string>(), It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>()))
                 .Returns((string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user) => {
-                    return MockPackageService.Object.CreatePackageAsync(nugetPackage, packageStreamMetadata, user, isVerified: false);
+                    var packageMetadata = PackageMetadata.FromNuspecReader(nugetPackage.GetNuspecReader());
+
+                    var package = new Package();
+                    package.PackageRegistration = new PackageRegistration { Id = packageMetadata.Id, IsVerified = false };
+                    package.Version = packageMetadata.Version.ToString();
+                    package.SemVerLevelKey = SemVerLevelKey.ForPackage(packageMetadata.Version, packageMetadata.GetDependencyGroups().AsPackageDependencyEnumerable());
+
+                    return Task.FromResult(package);
                 });
 
             var requestMock = new Mock<HttpRequestBase>();
@@ -152,82 +147,6 @@ public async Task CreatePackage_Returns400IfSecurityPolicyFails()
                 ResultAssert.IsStatusCode(result, HttpStatusCode.BadRequest, "A");
             }
 
-            [Fact]
-            public async Task CreatePackageWillSavePackageFileToFileStorage()
-            {
-                // Arrange
-                var user = new User() { EmailAddress = "confirmed@email.com" };
-                var packageRegistration = new PackageRegistration();
-                packageRegistration.Id = "theId";
-                packageRegistration.Owners.Add(user);
-                var package = new Package();
-                package.PackageRegistration = packageRegistration;
-                package.Version = "1.0.42";
-                packageRegistration.Packages.Add(package);
-
-                var controller = new TestableApiController(GetConfigurationService());
-                controller.SetCurrentUser(user);
-                controller.MockPackageFileService.Setup(p => p.SavePackageFileAsync(It.IsAny<Package>(), It.IsAny<Stream>()))
-                    .Returns(Task.CompletedTask).Verifiable();
-                controller.MockPackageService.Setup(p => p.FindPackageRegistrationById(It.IsAny<string>()))
-                    .Returns(packageRegistration);
-                controller.MockPackageService.Setup(p => p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
-                    .Returns(Task.FromResult(package));
-
-                var nuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.42");
-                controller.SetupPackageFromInputStream(nuGetPackage);
-
-                // Act
-                await controller.CreatePackagePut();
-
-                // Assert
-                controller.MockPackageFileService.Verify();
-            }
-
-            [Fact]
-            public async Task WillDeletePackageFileFromBlobStorageIfSavingDbChangesFails()
-            {
-                // Arrange
-                var user = new User() { EmailAddress = "confirmed@email.com" };
-                var packageId = "theId";
-                var packageVersion = "1.0.42";
-                var packageRegistration = new PackageRegistration();
-                packageRegistration.Id = packageId;
-                packageRegistration.Owners.Add(user);
-                var package = new Package();
-                package.PackageRegistration = packageRegistration;
-                package.Version = "1.0.42";
-                packageRegistration.Packages.Add(package);
-
-                var controller = new TestableApiController(GetConfigurationService());
-                controller.SetCurrentUser(user);
-                controller.MockPackageFileService.Setup(
-                        p => p.SavePackageFileAsync(It.IsAny<Package>(), It.IsAny<Stream>()))
-                    .Returns(Task.CompletedTask).Verifiable();
-                controller.MockPackageFileService.Setup(
-                        p =>
-                            p.DeletePackageFileAsync(packageId,
-                                packageVersion))
-                    .Returns(Task.CompletedTask).Verifiable();
-                controller.MockPackageService.Setup(p => p.FindPackageRegistrationById(It.IsAny<string>()))
-                    .Returns(packageRegistration);
-                controller.MockPackageService.Setup(
-                        p =>
-                            p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(),
-                                It.IsAny<User>(), It.IsAny<bool>()))
-                    .Returns(Task.FromResult(package));
-                controller.MockEntitiesContext.Setup(e => e.SaveChangesAsync()).Throws<Exception>();
-
-                var nuGetPackage = TestPackage.CreateTestPackageStream(packageId, "1.0.42");
-                controller.SetupPackageFromInputStream(nuGetPackage);
-
-                // Act
-                await Assert.ThrowsAsync<Exception>(async () => await controller.CreatePackagePut());
-
-                // Assert
-                controller.MockPackageFileService.Verify();
-            }
-
             [Fact]
             public async Task WritesAnAuditRecord()
             {
@@ -243,7 +162,12 @@ public async Task WritesAnAuditRecord()
 
                 var controller = new TestableApiController(GetConfigurationService());
                 controller.SetCurrentUser(user);
-                controller.MockPackageService.Setup(p => p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                controller.MockPackageUploadService
+                    .Setup(p => p.GeneratePackageAsync(
+                        It.IsAny<string>(),
+                        It.IsAny<PackageArchiveReader>(),
+                        It.IsAny<PackageStreamMetadata>(),
+                        It.IsAny<User>()))
                     .Returns(Task.FromResult(package));
 
                 var nuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.42");
@@ -276,7 +200,12 @@ public async Task CreatePackageWillSendPackageAddedNotice()
                 controller.SetCurrentUser(user);
                 controller.MockMessageService.Setup(p => p.SendPackageAddedNotice(package, It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>()))
                     .Verifiable();
-                controller.MockPackageService.Setup(p => p.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                controller.MockPackageUploadService
+                    .Setup(p => p.GeneratePackageAsync(
+                        It.IsAny<string>(),
+                        It.IsAny<PackageArchiveReader>(),
+                        It.IsAny<PackageStreamMetadata>(),
+                        It.IsAny<User>()))
                     .Returns(Task.FromResult(package));
 
                 var nuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.42");
@@ -299,8 +228,6 @@ public async Task CreatePackageWillReturn400IfFileIsNotANuGetPackage()
 
                 var controller = new TestableApiController(GetConfigurationService());
                 controller.SetCurrentUser(user);
-                controller.MockPackageFileService.Setup(p => p.SavePackageFileAsync(It.IsAny<Package>(), It.IsAny<Stream>()))
-                    .Returns(Task.CompletedTask).Verifiable();
                 controller.MockPackageService.Setup(p => p.FindPackageRegistrationById(It.IsAny<string>()))
                     .Returns(packageRegistration);
 
@@ -462,15 +389,16 @@ public async Task WillReturnConflictIfAPackageWithTheIdExistsBelongingToAnotherU
             }
 
             [Fact]
-            public async Task WillReturnConflictIfSavingPackageBlobFailsOnConflict()
+            public async Task WillReturnConflictIfCommittingPackageReturnsConflict()
             {
                 // Arrange
                 var user = new User { EmailAddress = "confirmed@email.com" };
                 var controller = new TestableApiController(GetConfigurationService());
                 controller.SetCurrentUser(user);
-                controller.MockPackageFileService.Setup(
-                        x => x.SavePackageFileAsync(It.IsAny<Package>(), It.IsAny<Stream>()))
-                    .Throws<InvalidOperationException>();
+                controller
+                    .MockPackageUploadService
+                    .Setup(x => x.CommitPackageAsync(It.IsAny<Package>(), It.IsAny<Stream>()))
+                    .ReturnsAsync(PackageCommitResult.Conflict);
 
                 var nuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.42");
                 controller.SetCurrentUser(new User());
@@ -488,6 +416,36 @@ public async Task WillReturnConflictIfSavingPackageBlobFailsOnConflict()
                 controller.MockEntitiesContext.VerifyCommitted(Times.Never());
             }
 
+            public static IEnumerable<object[]> CommitResults => Enum
+                .GetValues(typeof(PackageCommitResult))
+                .Cast<PackageCommitResult>()
+                .Select(r => new object[] { r });
+
+            [Theory]
+            [MemberData(nameof(CommitResults))]
+            public async Task DoesNotThrowForAnyPackageCommitResult(PackageCommitResult commitResult)
+            {
+                var nuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.42");
+
+                var user = new User() { EmailAddress = "confirmed@email.com" };
+                var controller = new TestableApiController(GetConfigurationService());
+                controller.SetCurrentUser(user);
+                controller.SetupPackageFromInputStream(nuGetPackage);
+                controller.MockPackageUploadService
+                    .Setup(x => x.CommitPackageAsync(
+                        It.IsAny<Package>(),
+                        It.IsAny<Stream>()))
+                    .ReturnsAsync(commitResult);
+
+                await controller.CreatePackagePut();
+
+                controller.MockPackageUploadService.Verify(
+                    x => x.CommitPackageAsync(
+                        It.IsAny<Package>(),
+                        It.IsAny<Stream>()),
+                    Times.Once);
+            }
+
             [Fact]
             public async Task WillReturnConflictIfAPackageWithTheIdMatchesNonOwnedNamespace()
             {
@@ -538,8 +496,13 @@ public async Task WillCreateAPackageFromTheNuGetPackage()
 
                 await controller.CreatePackagePut();
 
-                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
-                controller.MockEntitiesContext.VerifyCommitted();
+                controller.MockPackageUploadService.Verify(
+                    x => x.GeneratePackageAsync(
+                        It.IsAny<string>(),
+                        It.IsAny<PackageArchiveReader>(),
+                        It.IsAny<PackageStreamMetadata>(),
+                        It.IsAny<User>()),
+                    Times.Once);
             }
 
             [Fact]
@@ -574,8 +537,12 @@ public async Task WillCreatePackageIfIdMatchesSharedNamespace()
                 var result = await controller.CreatePackagePut();
 
                 // Assert
-                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
-                controller.MockEntitiesContext.VerifyCommitted();
+                controller.MockPackageUploadService.Verify(
+                    x => x.GeneratePackageAsync(
+                        It.IsAny<string>(),
+                        It.IsAny<PackageArchiveReader>(),
+                        It.IsAny<PackageStreamMetadata>(),
+                        It.IsAny<User>()));
             }
 
             [Fact]
@@ -609,8 +576,13 @@ public async Task WillCreatePackageIfIdMatchesAnOwnedNamespace()
                 var result = await controller.CreatePackagePut();
 
                 // Assert
-                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
-                controller.MockEntitiesContext.VerifyCommitted();
+                controller.MockPackageUploadService.Verify(
+                    x => x.GeneratePackageAsync(
+                        It.IsAny<string>(),
+                        It.IsAny<PackageArchiveReader>(),
+                        It.IsAny<PackageStreamMetadata>(),
+                        It.IsAny<User>()),
+                    Times.Once);
             }
 
             [Fact]
@@ -641,7 +613,6 @@ public async Task WillCurateThePackage()
                 await controller.CreatePackagePut();
 
                 controller.MockAutoCuratePackage.Verify(x => x.ExecuteAsync(It.IsAny<Package>(), It.IsAny<PackageArchiveReader>(), false));
-                controller.MockEntitiesContext.VerifyCommitted();
             }
 
             [Fact]
@@ -657,7 +628,6 @@ public async Task WillCurateThePackageViaApi()
                 await controller.CreatePackagePost();
 
                 controller.MockAutoCuratePackage.Verify(x => x.ExecuteAsync(It.IsAny<Package>(), It.IsAny<PackageArchiveReader>(), false));
-                controller.MockEntitiesContext.VerifyCommitted();
             }
 
             [Fact]
@@ -672,8 +642,13 @@ public async Task WillCreateAPackageWithTheUserMatchingTheApiKey()
 
                 await controller.CreatePackagePut();
 
-                controller.MockPackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user, It.IsAny<bool>()));
-                controller.MockEntitiesContext.VerifyCommitted();
+                controller.MockPackageUploadService.Verify(
+                    x => x.GeneratePackageAsync(
+                        It.IsAny<string>(),
+                        It.IsAny<PackageArchiveReader>(),
+                        It.IsAny<PackageStreamMetadata>(),
+                        user),
+                    Times.Once);
             }
 
             [InlineData("[{\"a\":\"package:push\", \"s\":\"theId\"}]", true)]
@@ -695,10 +670,13 @@ public async Task WillVerifyScopesForNewPackageId(string apiKeyScopes, bool isPu
                 var controller = new TestableApiController(GetConfigurationService());
                 controller.SetCurrentUser(user, apiKeyScopes);
                 controller.SetupPackageFromInputStream(nuGetPackage);
-                controller.MockPackageService.Setup(
-                    x =>
-                        x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user,
-                            It.IsAny<bool>())).Returns(Task.FromResult(package));
+                controller.MockPackageUploadService
+                    .Setup(x => x.GeneratePackageAsync(
+                        It.IsAny<string>(),
+                        It.IsAny<PackageArchiveReader>(),
+                        It.IsAny<PackageStreamMetadata>(),
+                        user))
+                    .ReturnsAsync(package);
 
                 // Act
                 var result = await controller.CreatePackagePut();
@@ -706,18 +684,21 @@ public async Task WillVerifyScopesForNewPackageId(string apiKeyScopes, bool isPu
                 // Assert
                 if (isPushAllowed)
                 {
-                    controller.MockPackageService.Verify(
-                        x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user, It.IsAny<bool>()));
-                    controller.MockEntitiesContext.VerifyCommitted();
+                    controller.MockPackageUploadService.Verify(
+                        x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            user));
                 }
                 else
                 {
-                    controller.MockPackageService.Verify(
-                        x => x.CreatePackageAsync(
+                    controller.MockPackageUploadService.Verify(
+                        x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
                             It.IsAny<PackageArchiveReader>(),
                             It.IsAny<PackageStreamMetadata>(),
-                            It.IsAny<User>(),
-                            It.IsAny<bool>()),
+                            It.IsAny<User>()),
                         Times.Never);
 
                     ResultAssert.IsStatusCode(
@@ -754,10 +735,13 @@ public async Task WillVerifyScopesForExistingPackageId(string apiKeyScopes, bool
 
                 controller.MockPackageService.Setup(x => x.FindPackageRegistrationById(packageId))
                     .Returns(packageRegistration);
-                controller.MockPackageService.Setup(
-                    x =>
-                        x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user,
-                            It.IsAny<bool>())).Returns(Task.FromResult(package));
+                controller.MockPackageUploadService
+                    .Setup(x => x.GeneratePackageAsync(
+                        It.IsAny<string>(),
+                        It.IsAny<PackageArchiveReader>(),
+                        It.IsAny<PackageStreamMetadata>(),
+                        user))
+                    .ReturnsAsync(package);
 
                 // Act
                 var result = await controller.CreatePackagePut();
@@ -765,18 +749,21 @@ public async Task WillVerifyScopesForExistingPackageId(string apiKeyScopes, bool
                 // Assert
                 if (isPushAllowed)
                 {
-                    controller.MockPackageService.Verify(
-                        x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), user, It.IsAny<bool>()));
-                    controller.MockEntitiesContext.VerifyCommitted();
+                    controller.MockPackageUploadService.Verify(
+                        x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            user));
                 }
                 else
                 {
-                    controller.MockPackageService.Verify(
-                        x => x.CreatePackageAsync(
+                    controller.MockPackageUploadService.Verify(
+                        x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
                             It.IsAny<PackageArchiveReader>(),
                             It.IsAny<PackageStreamMetadata>(),
-                            It.IsAny<User>(),
-                            It.IsAny<bool>()),
+                            It.IsAny<User>()),
                         Times.Never);
 
                     ResultAssert.IsStatusCode(
diff --git a/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
index 17b6bc46fc..102802b1d4 100644
--- a/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
@@ -6,6 +6,7 @@
 using System.IO;
 using System.Linq;
 using System.Linq.Expressions;
+using System.Net;
 using System.Net.Mail;
 using System.Threading.Tasks;
 using System.Web;
@@ -104,12 +105,6 @@ private static PackagesController CreateController(
 
             packageUploadService = packageUploadService ?? new Mock<IPackageUploadService>();
 
-            packageUploadService.Setup(x => x.GeneratePackageAsync(It.IsAny<string>(), It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>()))
-                .Returns((string id, PackageArchiveReader nugetPackage, PackageStreamMetadata packageStreamMetadata, User user) =>
-                {
-                    return packageService.Object.CreatePackageAsync(nugetPackage, packageStreamMetadata, user, isVerified: false);
-                });
-
             validationService = validationService ?? new Mock<IValidationService>();
 
             var controller = new Mock<PackagesController>(
@@ -2101,145 +2096,118 @@ public async Task WillRedirectToUploadPageWhenThereIsNoUploadInProgress()
             }
 
             [Fact]
-            public async Task WillCreateThePackage()
+            public async Task WillReturnConflictIfCommittingReturnsConflict()
             {
                 var fakeUploadFileService = new Mock<IUploadFileService>();
                 using (var fakeFileStream = new MemoryStream())
                 {
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
-                    var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>())).Returns(
-                        Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
+                        .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
+                    fakePackageUploadService
+                        .Setup(x => x.CommitPackageAsync(
+                            It.IsAny<Package>(),
+                            It.IsAny<Stream>()))
+                        .ReturnsAsync(PackageCommitResult.Conflict);
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
                     var controller = CreateController(
                         GetConfigurationService(),
-                        packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage);
                     controller.SetCurrentUser(TestUtility.FakeUser);
 
-                    await controller.VerifyPackage(new VerifyPackageRequest() { Listed = true, Edit = null });
+                    var result = await controller.VerifyPackage(new VerifyPackageRequest() { Listed = true, Edit = null });
 
-                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
+                    var jsonResult = Assert.IsType<JsonResult>(result);
+                    Assert.Equal((int)HttpStatusCode.Conflict, controller.Response.StatusCode);
                 }
             }
 
-            [Fact]
-            public async Task WillSavePackageToFileStorage()
+            public static IEnumerable<object[]> CommitResults => Enum
+                .GetValues(typeof(PackageCommitResult))
+                .Cast<PackageCommitResult>()
+                .Select(r => new object[] { r });
+
+            [Theory]
+            [MemberData(nameof(CommitResults))]
+            public async Task DoesNotThrowForAnyPackageCommitResult(PackageCommitResult commitResult)
             {
-                // Arrange
                 var fakeUploadFileService = new Mock<IUploadFileService>();
                 using (var fakeFileStream = new MemoryStream())
                 {
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
-                    var fakePackageService = new Mock<IPackageService>();
-                    var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
-                        .Returns(Task.FromResult(fakePackage));
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
+                        .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
+                    fakePackageUploadService
+                        .Setup(x => x.CommitPackageAsync(
+                            It.IsAny<Package>(),
+                            It.IsAny<Stream>()))
+                        .ReturnsAsync(commitResult);
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
-                    var fakePackageFileService = new Mock<IPackageFileService>();
-                    fakePackageFileService.Setup(x => x.SavePackageFileAsync(fakePackage, It.IsAny<Stream>())).Returns(Task.FromResult(0)).Verifiable();
-
                     var controller = CreateController(
                         GetConfigurationService(),
-                        packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
-                        fakeNuGetPackage: fakeNuGetPackage,
-                        packageFileService: fakePackageFileService);
+                        fakeNuGetPackage: fakeNuGetPackage);
                     controller.SetCurrentUser(TestUtility.FakeUser);
 
-                    // Act
                     await controller.VerifyPackage(new VerifyPackageRequest() { Listed = true, Edit = null });
 
-                    // Assert
-                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
-                    fakePackageFileService.Verify();
-                }
-            }
-
-            [Fact]
-            public async Task WillDeletePackageFileFromBlobStorageIfSavingDbChangesFails()
-            {
-                // Arrange
-                var packageId = "theId";
-                var packageVersion = "1.0.0";
-                var fakeUploadFileService = new Mock<IUploadFileService>();
-                using (var fakeFileStream = new MemoryStream())
-                {
-                    fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
-                    fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
-                    var fakePackageService = new Mock<IPackageService>();
-                    var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = packageId }, Version = packageVersion };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
-                        .Returns(Task.FromResult(fakePackage));
-                    var fakeNuGetPackage = TestPackage.CreateTestPackageStream(packageId, packageVersion);
-
-                    var fakePackageFileService = new Mock<IPackageFileService>();
-                    fakePackageFileService.Setup(x => x.SavePackageFileAsync(fakePackage, It.IsAny<Stream>())).Returns(Task.CompletedTask).Verifiable();
-                    fakePackageFileService.Setup(x => x.DeletePackageFileAsync(packageId, packageVersion)).Returns(Task.CompletedTask).Verifiable();
-
-                    var fakeEntitiesContext = new Mock<IEntitiesContext>();
-                    fakeEntitiesContext.Setup(e => e.SaveChangesAsync()).Throws<Exception>();
-
-                    var controller = CreateController(
-                        GetConfigurationService(),
-                        packageService: fakePackageService,
-                        uploadFileService: fakeUploadFileService,
-                        fakeNuGetPackage: fakeNuGetPackage,
-                        packageFileService: fakePackageFileService,
-                        entitiesContext: fakeEntitiesContext);
-                    controller.SetCurrentUser(TestUtility.FakeUser);
-
-                    // Act
-                    await Assert.ThrowsAsync<Exception>(async () => await controller.VerifyPackage(new VerifyPackageRequest() { Listed = true, Edit = null }));
-
-                    // Assert
-                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
-                    fakePackageFileService.Verify();
+                    fakePackageUploadService.Verify(x => x.CommitPackageAsync(
+                        It.IsAny<Package>(),
+                        It.IsAny<Stream>()), Times.Once);
                 }
             }
 
             [Fact]
-            public async Task WillShowViewWithMessageIfSavingPackageBlobFails()
+            public async Task WillCreateThePackage()
             {
-                // Arrange
                 var fakeUploadFileService = new Mock<IUploadFileService>();
                 using (var fakeFileStream = new MemoryStream())
                 {
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
-                    var fakePackageService = new Mock<IPackageService>();
-                    var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
-                        .Returns(Task.FromResult(fakePackage));
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
+                        .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
-                    var fakePackageFileService = new Mock<IPackageFileService>();
-                    fakePackageFileService.Setup(x => x.SavePackageFileAsync(fakePackage, It.IsAny<Stream>()))
-                        .Throws<InvalidOperationException>();
-
-                    var fakeEntitiesContext = new Mock<IEntitiesContext>();
-
                     var controller = CreateController(
                         GetConfigurationService(),
-                        packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
-                        fakeNuGetPackage: fakeNuGetPackage,
-                        packageFileService: fakePackageFileService,
-                        entitiesContext: fakeEntitiesContext);
+                        fakeNuGetPackage: fakeNuGetPackage);
                     controller.SetCurrentUser(TestUtility.FakeUser);
 
-                    // Act
                     await controller.VerifyPackage(new VerifyPackageRequest() { Listed = true, Edit = null });
 
-                    // Assert
-                    fakePackageService.Verify(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()));
-                    Assert.Equal(Strings.UploadPackage_IdVersionConflict, controller.TempData["Message"]);
-                    fakeEntitiesContext.VerifyCommitted(Times.Never());
+                    fakePackageUploadService.Verify(x => x.GeneratePackageAsync(
+                        It.IsAny<string>(),
+                        It.IsAny<PackageArchiveReader>(),
+                        It.IsAny<PackageStreamMetadata>(),
+                        It.IsAny<User>()), Times.Once);
                 }
             }
 
@@ -2253,8 +2221,14 @@ public async Task WillUpdateIndexingService()
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
                     var fakePackageFileService = new Mock<IPackageFileService>();
@@ -2266,6 +2240,7 @@ public async Task WillUpdateIndexingService()
                     var controller = CreateController(
                         GetConfigurationService(),
                         packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage,
                         packageFileService: fakePackageFileService,
@@ -2280,43 +2255,6 @@ public async Task WillUpdateIndexingService()
                 }
             }
 
-            [Fact]
-            public async Task WillSaveChangesToEntitiesContext()
-            {
-                // Arrange
-                var fakeUploadFileService = new Mock<IUploadFileService>();
-                using (var fakeFileStream = new MemoryStream())
-                {
-                    fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key))
-                        .Returns(Task.FromResult<Stream>(fakeFileStream));
-                    fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key))
-                        .Returns(Task.CompletedTask);
-                    var fakePackageService = new Mock<IPackageService>();
-                    var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
-                        .Returns(Task.FromResult(fakePackage));
-                    var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
-
-                    var entitiesContext = new Mock<IEntitiesContext>();
-                    entitiesContext.Setup(e => e.SaveChangesAsync())
-                        .Returns(Task.FromResult(0)).Verifiable();
-
-                    var controller = CreateController(
-                        GetConfigurationService(),
-                        packageService: fakePackageService,
-                        uploadFileService: fakeUploadFileService,
-                        fakeNuGetPackage: fakeNuGetPackage,
-                        entitiesContext: entitiesContext);
-                    controller.SetCurrentUser(TestUtility.FakeUser);
-
-                    // Act
-                    await controller.VerifyPackage(new VerifyPackageRequest() { Listed = true, Edit = null });
-
-                    // Assert
-                    entitiesContext.Verify();
-                }
-            }
-
             [Fact]
             public async Task WillNotCommitChangesToPackageService()
             {
@@ -2329,8 +2267,14 @@ public async Task WillNotCommitChangesToPackageService()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key))
                         .Returns(Task.CompletedTask);
                     var fakePackageService = new Mock<IPackageService>(MockBehavior.Strict);
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(fakePackage));
                     fakePackageService.Setup(x => x.PublishPackageAsync(fakePackage, false))
                         .Returns(Task.CompletedTask);
@@ -2341,6 +2285,7 @@ public async Task WillNotCommitChangesToPackageService()
                     var controller = CreateController(
                         GetConfigurationService(),
                         packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage);
                     controller.SetCurrentUser(TestUtility.FakeUser);
@@ -2363,13 +2308,20 @@ public async Task WillPublishThePackage()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
                     var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
                     var controller = CreateController(
                         GetConfigurationService(),
                         packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage);
                     controller.SetCurrentUser(TestUtility.FakeUser);
@@ -2389,13 +2341,20 @@ public async Task WillMarkThePackageUnlistedWhenListedArgumentIsFalse()
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
                     var controller = CreateController(
                         GetConfigurationService(),
                         packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage);
                     controller.SetCurrentUser(TestUtility.FakeUser);
@@ -2418,13 +2377,20 @@ public async Task WillNotMarkThePackageUnlistedWhenListedArgumentIsNullorTrue(bo
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
                     var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
                     var controller = CreateController(
                         GetConfigurationService(),
                         packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage);
                     controller.SetCurrentUser(TestUtility.FakeUser);
@@ -2443,14 +2409,19 @@ public async Task WillDeleteTheUploadFile()
                 using (var fakeFileStream = new MemoryStream())
                 {
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
-                    var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    var facePackageUploadService = new Mock<IPackageUploadService>();
+                    facePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
                     var controller = CreateController(
                         GetConfigurationService(),
-                        packageService: fakePackageService,
+                        packageUploadService: facePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage);
                     controller.SetCurrentUser(TestUtility.FakeUser);
@@ -2470,14 +2441,19 @@ public async Task WillSetAFlashMessage()
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.SaveUploadFileAsync(TestUtility.FakeUser.Key, It.IsAny<Stream>())).Returns(Task.FromResult(0));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
-                    var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
                     var controller = CreateController(
                         GetConfigurationService(),
-                        packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage);
                     controller.SetCurrentUser(TestUtility.FakeUser);
@@ -2496,14 +2472,19 @@ public async Task WillRedirectToPackagePage()
                 {
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
-                    var fakePackageService = new Mock<IPackageService>();
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" }));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
                     var controller = CreateController(
                         GetConfigurationService(),
-                        packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage);
                     controller.SetCurrentUser(TestUtility.FakeUser);
@@ -2527,16 +2508,21 @@ public async Task WillCurateThePackage()
                 {
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
-                    var fakePackageService = new Mock<IPackageService>();
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
                     var fakeAutoCuratePackageCmd = new Mock<IAutomaticallyCuratePackageCommand>();
                     var controller = CreateController(
                         GetConfigurationService(),
-                        packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage,
                         autoCuratePackageCmd: fakeAutoCuratePackageCmd);
@@ -2557,9 +2543,14 @@ public async Task WritesAnAuditRecord()
                 {
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult(0));
-                    var fakePackageService = new Mock<IPackageService>();
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
 
@@ -2567,7 +2558,7 @@ public async Task WritesAnAuditRecord()
 
                     var controller = CreateController(
                         GetConfigurationService(),
-                        packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage,
                         auditingService: auditingService);
@@ -2593,16 +2584,21 @@ public async Task WillSendPackagePublishedEvent()
                 {
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.CompletedTask);
-                    var fakePackageService = new Mock<IPackageService>();
+                    var fakePackageUploadService = new Mock<IPackageUploadService>();
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "theId" }, Version = "theVersion" };
-                    fakePackageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    fakePackageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(fakePackage));
                     var fakeNuGetPackage = TestPackage.CreateTestPackageStream("theId", "1.0.0");
                     var fakeTelemetryService = new Mock<ITelemetryService>();
 
                     var controller = CreateController(
                         GetConfigurationService(),
-                        packageService: fakePackageService,
+                        packageUploadService: fakePackageUploadService,
                         uploadFileService: fakeUploadFileService,
                         fakeNuGetPackage: fakeNuGetPackage,
                         telemetryService: fakeTelemetryService);
@@ -2648,10 +2644,15 @@ public async Task WillApplyEdits(EditPackageVersionRequest edit)
                     fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                     fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.CompletedTask);
 
-                    var packageService = new Mock<IPackageService>();
+                    var packageUploadService = new Mock<IPackageUploadService>();
 
                     var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "thePackageId" }, Version = "1.0.0" };
-                    packageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(), It.IsAny<User>(), It.IsAny<bool>()))
+                    packageUploadService
+                        .Setup(x => x.GeneratePackageAsync(
+                            It.IsAny<string>(),
+                            It.IsAny<PackageArchiveReader>(),
+                            It.IsAny<PackageStreamMetadata>(),
+                            It.IsAny<User>()))
                         .Returns(Task.FromResult(fakePackage));
 
                     var fakeEditPackageService = new Mock<EditPackageService>();
@@ -2661,7 +2662,7 @@ public async Task WillApplyEdits(EditPackageVersionRequest edit)
 
                     var controller = CreateController(
                         GetConfigurationService(),
-                        packageService: packageService,
+                        packageUploadService: packageUploadService,
                         editPackageService: fakeEditPackageService,
                         uploadFileService: fakeUploadFileService,
                         packageFileService: fakePackageFileService);
@@ -2711,11 +2712,15 @@ public async Task WillApplyReadMeForWrittenReadMeData(EditPackageVersionRequest
                 fakeUploadFileService.Setup(x => x.GetUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.FromResult<Stream>(fakeFileStream));
                 fakeUploadFileService.Setup(x => x.DeleteUploadFileAsync(TestUtility.FakeUser.Key)).Returns(Task.CompletedTask);
 
-                var packageService = new Mock<IPackageService>();
+                var packageUploadService = new Mock<IPackageUploadService>();
 
                 var fakePackage = new Package { PackageRegistration = new PackageRegistration { Id = "thePackageId" }, Version = "1.0.0" };
-                packageService.Setup(x => x.CreatePackageAsync(It.IsAny<PackageArchiveReader>(), It.IsAny<PackageStreamMetadata>(),
-                    It.IsAny<User>(), It.IsAny<bool>()))
+                packageUploadService.Setup(
+                    x => x.GeneratePackageAsync(
+                        It.IsAny<string>(),
+                        It.IsAny<PackageArchiveReader>(),
+                        It.IsAny<PackageStreamMetadata>(),
+                        It.IsAny<User>()))
                     .Returns(Task.FromResult(fakePackage));
 
                 var fakeEditPackageService = new Mock<EditPackageService>();
@@ -2725,7 +2730,7 @@ public async Task WillApplyReadMeForWrittenReadMeData(EditPackageVersionRequest
 
                 var controller = CreateController(
                     GetConfigurationService(),
-                    packageService: packageService,
+                    packageUploadService: packageUploadService,
                     editPackageService: fakeEditPackageService,
                     uploadFileService: fakeUploadFileService,
                     packageFileService: fakePackageFileService);
diff --git a/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs
index 01b4778822..eb59223c67 100644
--- a/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs
@@ -3,6 +3,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.IO;
 using System.Linq;
 using System.Threading.Tasks;
 using Moq;
@@ -15,6 +16,9 @@ namespace NuGetGallery
 {
     public class PackageUploadServiceFacts
     {
+        private const string Id = "NuGet.Versioning";
+        private const string Version = "3.4.0.0-ALPHA+1";
+
         public Mock<IPackageService> MockPackageService { get; private set; }
 
         private static PackageUploadService CreateService(
@@ -59,6 +63,8 @@ private static PackageUploadService CreateService(
 
             var packageUploadService = new Mock<PackageUploadService>(
                 packageService.Object,
+                new Mock<IPackageFileService>().Object,
+                new Mock<IEntitiesContext>().Object,
                 reservedNamespaceService.Object,
                 validationService.Object);
 
@@ -164,5 +170,119 @@ public async Task WillMarkPackageRegistrationNotVerifiedIfIdMatchesNonOwnedShare
                 Assert.False(package.PackageRegistration.IsVerified);
             }
         }
+
+        public class TheCommitPackageMethod : FactsBase
+        {
+            [Fact]
+            public async Task SavesPackageToStorageAndDatabase()
+            {
+                var result = await _target.CommitPackageAsync(_package, _packageFile);
+
+                _packageFileService.Verify(
+                    x => x.SavePackageFileAsync(_package, _packageFile),
+                    Times.Once);
+                _packageFileService.Verify(
+                    x => x.SavePackageFileAsync(It.IsAny<Package>(), It.IsAny<Stream>()),
+                    Times.Once);
+                _entitiesContext.Verify(
+                    x => x.SaveChangesAsync(),
+                    Times.Once);
+                Assert.Equal(PackageCommitResult.Success, result);
+            }
+
+            [Fact]
+            public async Task DoesNotCommitToDatabaseWhenSavingTheFileFails()
+            {
+                _packageFileService
+                    .Setup(x => x.SavePackageFileAsync(It.IsAny<Package>(), It.IsAny<Stream>()))
+                    .Throws(_unexpectedException);
+
+                var exception = await Assert.ThrowsAsync(
+                    _unexpectedException.GetType(),
+                    () => _target.CommitPackageAsync(_package, _packageFile));
+
+                _entitiesContext.Verify(
+                    x => x.SaveChangesAsync(),
+                    Times.Never);
+                Assert.Same(_unexpectedException, exception);
+            }
+
+            [Fact]
+            public async Task DoesNotCommitToDatabaseWhenTheFileConflicts()
+            {
+                _packageFileService
+                    .Setup(x => x.SavePackageFileAsync(It.IsAny<Package>(), It.IsAny<Stream>()))
+                    .Throws(_conflictException);
+
+                var result = await _target.CommitPackageAsync(_package, _packageFile);
+
+                _entitiesContext.Verify(
+                    x => x.SaveChangesAsync(),
+                    Times.Never);
+                Assert.Equal(PackageCommitResult.Conflict, result);
+            }
+
+            [Fact]
+            public async Task DeletesPackageIfDatabaseCommitFails()
+            {
+                _entitiesContext
+                    .Setup(x => x.SaveChangesAsync())
+                    .Throws(_unexpectedException);
+
+                var exception = await Assert.ThrowsAsync(
+                    _unexpectedException.GetType(),
+                    () => _target.CommitPackageAsync(_package, _packageFile));
+
+                _packageFileService.Verify(
+                    x => x.DeletePackageFileAsync(Id, Version),
+                    Times.Once);
+                _packageFileService.Verify(
+                    x => x.DeletePackageFileAsync(It.IsAny<string>(), It.IsAny<string>()),
+                    Times.Once);
+                Assert.Same(_unexpectedException, exception);
+            }
+        }
+
+        public abstract class FactsBase
+        {
+            protected readonly Mock<IPackageService> _packageService;
+            protected readonly Mock<IPackageFileService> _packageFileService;
+            protected readonly Mock<IEntitiesContext> _entitiesContext;
+            protected readonly Mock<IReservedNamespaceService> _reservedNamespaceService;
+            protected readonly Mock<IValidationService> _validationService;
+            protected Package _package;
+            protected Stream _packageFile;
+            protected ArgumentException _unexpectedException;
+            protected InvalidOperationException _conflictException;
+            protected readonly PackageUploadService _target;
+
+            public FactsBase()
+            {
+                _packageService = new Mock<IPackageService>();
+                _packageFileService = new Mock<IPackageFileService>();
+                _entitiesContext = new Mock<IEntitiesContext>();
+                _reservedNamespaceService = new Mock<IReservedNamespaceService>();
+                _validationService = new Mock<IValidationService>();
+
+                _package = new Package
+                {
+                    PackageRegistration = new PackageRegistration
+                    {
+                        Id = Id,
+                    },
+                    Version = Version,
+                };
+                _packageFile = Stream.Null;
+                _unexpectedException = new ArgumentException("Fail!");
+                _conflictException = new InvalidOperationException("Conflict!");
+
+                _target = new PackageUploadService(
+                    _packageService.Object,
+                    _packageFileService.Object,
+                    _entitiesContext.Object,
+                    _reservedNamespaceService.Object,
+                    _validationService.Object);
+            }
+        }
     }
 }
\ No newline at end of file

From ec33899a14ff914a3a63eaf45cb0c584c975edee Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Thu, 28 Sep 2017 09:45:00 -0700
Subject: [PATCH 22/25] Write to the validation container if the package starts
 in the Validating status (#4766)

Progress on https://github.com/NuGet/NuGetGallery/issues/4646
---
 .../Services/PackageUploadService.cs          | 32 ++++++-
 .../Services/PackageUploadServiceFacts.cs     | 90 ++++++++++++++++++-
 2 files changed, 116 insertions(+), 6 deletions(-)

diff --git a/src/NuGetGallery/Services/PackageUploadService.cs b/src/NuGetGallery/Services/PackageUploadService.cs
index 2546fc736d..f58a1f4f15 100644
--- a/src/NuGetGallery/Services/PackageUploadService.cs
+++ b/src/NuGetGallery/Services/PackageUploadService.cs
@@ -66,9 +66,24 @@ public async Task<Package> GeneratePackageAsync(
 
         public async Task<PackageCommitResult> CommitPackageAsync(Package package, Stream packageFile)
         {
+            if (package.PackageStatusKey != PackageStatus.Available
+                && package.PackageStatusKey != PackageStatus.Validating)
+            {
+                throw new ArgumentException(
+                    $"The package to commit must have either the {PackageStatus.Available} or {PackageStatus.Validating} package status.",
+                    nameof(package));
+            }
+
             try
             {
-                await _packageFileService.SavePackageFileAsync(package, packageFile);
+                if (package.PackageStatusKey == PackageStatus.Validating)
+                {
+                    await _packageFileService.SaveValidationPackageFileAsync(package, packageFile);
+                }
+                else
+                {
+                    await _packageFileService.SavePackageFileAsync(package, packageFile);
+                }
             }
             catch (InvalidOperationException ex)
             {
@@ -84,9 +99,18 @@ public async Task<PackageCommitResult> CommitPackageAsync(Package package, Strea
             catch
             {
                 // If saving to the DB fails for any reason we need to delete the package we just saved.
-                await _packageFileService.DeletePackageFileAsync(
-                    package.PackageRegistration.Id,
-                    package.Version);
+                if (package.PackageStatusKey == PackageStatus.Validating)
+                {
+                    await _packageFileService.DeleteValidationPackageFileAsync(
+                        package.PackageRegistration.Id,
+                        package.Version);
+                }
+                else
+                {
+                    await _packageFileService.DeletePackageFileAsync(
+                        package.PackageRegistration.Id,
+                        package.Version);
+                }
 
                 throw;
             }
diff --git a/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs
index eb59223c67..29fa77660a 100644
--- a/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageUploadServiceFacts.cs
@@ -173,9 +173,52 @@ public async Task WillMarkPackageRegistrationNotVerifiedIfIdMatchesNonOwnedShare
 
         public class TheCommitPackageMethod : FactsBase
         {
+            public static IEnumerable<object[]> SupportedPackageStatuses => new[]
+            {
+                new object[] { PackageStatus.Available },
+                new object[] { PackageStatus.Validating },
+            };
+
+            public static IEnumerable<object[]> UnsupportedPackageStatuses => Enum
+                .GetValues(typeof(PackageStatus))
+                .Cast<PackageStatus>()
+                .Concat(new[] { (PackageStatus)(-1) })
+                .Where(s => !SupportedPackageStatuses.Any(o => s.Equals(o[0])))
+                .Select(s => new object[] { s });
+            
+            [Theory]
+            [MemberData(nameof(SupportedPackageStatuses))]
+            public async Task CommitsAfterSavingSupportedPackageStatuses(PackageStatus packageStatus)
+            {
+                _package.PackageStatusKey = packageStatus;
+
+                var result = await _target.CommitPackageAsync(_package, _packageFile);
+
+                _entitiesContext.Verify(
+                    x => x.SaveChangesAsync(),
+                    Times.Once);
+                Assert.Equal(PackageCommitResult.Success, result);
+            }
+
+            [Theory]
+            [MemberData(nameof(UnsupportedPackageStatuses))]
+            public async Task RejectsUnsupportedPackageStatuses(PackageStatus packageStatus)
+            {
+                _package.PackageStatusKey = packageStatus;
+
+                await Assert.ThrowsAsync<ArgumentException>(
+                    () => _target.CommitPackageAsync(_package, _packageFile));
+
+                _entitiesContext.Verify(
+                    x => x.SaveChangesAsync(),
+                    Times.Never);
+            }
+
             [Fact]
-            public async Task SavesPackageToStorageAndDatabase()
+            public async Task SavesPackageToStorageAndDatabaseWhenAvailable()
             {
+                _package.PackageStatusKey = PackageStatus.Available;
+
                 var result = await _target.CommitPackageAsync(_package, _packageFile);
 
                 _packageFileService.Verify(
@@ -190,6 +233,25 @@ public async Task SavesPackageToStorageAndDatabase()
                 Assert.Equal(PackageCommitResult.Success, result);
             }
 
+            [Fact]
+            public async Task SavesPackageToStorageAndDatabaseWhenValidating()
+            {
+                _package.PackageStatusKey = PackageStatus.Validating;
+
+                var result = await _target.CommitPackageAsync(_package, _packageFile);
+
+                _packageFileService.Verify(
+                    x => x.SaveValidationPackageFileAsync(_package, _packageFile),
+                    Times.Once);
+                _packageFileService.Verify(
+                    x => x.SaveValidationPackageFileAsync(It.IsAny<Package>(), It.IsAny<Stream>()),
+                    Times.Once);
+                _entitiesContext.Verify(
+                    x => x.SaveChangesAsync(),
+                    Times.Once);
+                Assert.Equal(PackageCommitResult.Success, result);
+            }
+
             [Fact]
             public async Task DoesNotCommitToDatabaseWhenSavingTheFileFails()
             {
@@ -223,8 +285,10 @@ public async Task DoesNotCommitToDatabaseWhenTheFileConflicts()
             }
 
             [Fact]
-            public async Task DeletesPackageIfDatabaseCommitFails()
+            public async Task DeletesPackageIfDatabaseCommitFailsWhenAvailable()
             {
+                _package.PackageStatusKey = PackageStatus.Available;
+
                 _entitiesContext
                     .Setup(x => x.SaveChangesAsync())
                     .Throws(_unexpectedException);
@@ -241,6 +305,28 @@ public async Task DeletesPackageIfDatabaseCommitFails()
                     Times.Once);
                 Assert.Same(_unexpectedException, exception);
             }
+
+            [Fact]
+            public async Task DeletesPackageIfDatabaseCommitFailsWhenValidating()
+            {
+                _package.PackageStatusKey = PackageStatus.Validating;
+
+                _entitiesContext
+                    .Setup(x => x.SaveChangesAsync())
+                    .Throws(_unexpectedException);
+
+                var exception = await Assert.ThrowsAsync(
+                    _unexpectedException.GetType(),
+                    () => _target.CommitPackageAsync(_package, _packageFile));
+
+                _packageFileService.Verify(
+                    x => x.DeleteValidationPackageFileAsync(Id, Version),
+                    Times.Once);
+                _packageFileService.Verify(
+                    x => x.DeleteValidationPackageFileAsync(It.IsAny<string>(), It.IsAny<string>()),
+                    Times.Once);
+                Assert.Same(_unexpectedException, exception);
+            }
         }
 
         public abstract class FactsBase

From c882e083cabd860a8c3700ed676b723a24c1bc32 Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Thu, 28 Sep 2017 14:18:17 -0700
Subject: [PATCH 23/25] Backup package in validation package container during
 delete flow (and other little fixes) (#4773)

Fix https://github.com/NuGet/NuGetGallery/issues/3856
Fix https://github.com/NuGet/NuGetGallery/issues/4230
Address https://github.com/NuGet/NuGetGallery/issues/4648
Fix https://github.com/NuGet/NuGetGallery/issues/4683
---
 .../Admin/Controllers/DeleteController.cs     |  51 +++++-
 .../Admin/ViewModels/DeleteSearchResult.cs    |   6 +-
 .../Areas/Admin/ViewModels/UserViewModel.cs   |  11 ++
 .../Areas/Admin/Views/Delete/Index.cshtml     |  20 ++-
 src/NuGetGallery/NuGetGallery.csproj          |   1 +
 .../Services/PackageDeleteService.cs          |  12 ++
 src/NuGetGallery/UrlExtensions.cs             |   4 +-
 src/NuGetGallery/Web.config                   |  22 +--
 .../Controllers/DeleteControllerFacts.cs      | 107 +++++++++++
 .../ReservedNamespaceControllerFacts.cs       |   5 +-
 .../NuGetGallery.Facts.csproj                 |   1 +
 .../Services/PackageDeleteServiceFacts.cs     | 169 ++++++++++++++++--
 12 files changed, 374 insertions(+), 35 deletions(-)
 create mode 100644 src/NuGetGallery/Areas/Admin/ViewModels/UserViewModel.cs
 create mode 100644 tests/NuGetGallery.Facts/Areas/Admin/Controllers/DeleteControllerFacts.cs

diff --git a/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs b/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs
index aab78a5a94..0e9ea94e52 100644
--- a/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs
+++ b/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs
@@ -5,6 +5,7 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Web.Mvc;
+using System.Web.Routing;
 using NuGet.Versioning;
 using NuGetGallery.Areas.Admin.ViewModels;
 
@@ -49,16 +50,25 @@ public virtual ActionResult Search(string query)
 
             var queryParts = query.Split(new[] { ',', '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries);
 
-            var results = new List<DeleteSearchResult>();
+            var packages = new List<Package>();
+            var completedQueryParts = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
             foreach (var queryPart in queryParts)
             {
+                // Don't make the same query twice.
+                if (!completedQueryParts.Add(queryPart.Trim()))
+                {
+                    continue;
+                }
+
                 var splitQueryPart = queryPart.Split(new[] {' '}, StringSplitOptions.RemoveEmptyEntries);
                 if (splitQueryPart.Length == 1)
                 {
                     var resultingRegistration = _packageService.FindPackageRegistrationById(splitQueryPart[0].Trim());
                     if (resultingRegistration != null)
                     {
-                        results.AddRange(resultingRegistration.Packages.Select(CreateDeleteSearchResult));
+                        packages.AddRange(resultingRegistration
+                            .Packages
+                            .OrderBy(p => NuGetVersion.Parse(p.NormalizedVersion)));
                     }
                 }
                 else if (splitQueryPart.Length == 2)
@@ -66,10 +76,23 @@ public virtual ActionResult Search(string query)
                     var resultingPackage = _packageService.FindPackageByIdAndVersionStrict(splitQueryPart[0].Trim(), splitQueryPart[1].Trim());
                     if (resultingPackage != null)
                     {
-                        results.Add(CreateDeleteSearchResult(resultingPackage));
+                        packages.Add(resultingPackage);
                     }
                 }
             }
+
+            // Filter out duplicate packages and create the view model.
+            var uniquePackagesKeys = new HashSet<int>();
+            var results = new List<DeleteSearchResult>();
+            foreach (var package in packages)
+            {
+                if (!uniquePackagesKeys.Add(package.Key))
+                {
+                    continue;
+                }
+
+                results.Add(CreateDeleteSearchResult(package));
+            }
             
             return Json(results, JsonRequestBehavior.AllowGet);
         }
@@ -83,8 +106,28 @@ private DeleteSearchResult CreateDeleteSearchResult(Package package)
                     ? package.NormalizedVersion 
                     : NuGetVersion.Parse(package.Version).ToNormalizedString(),
                 DownloadCount = package.DownloadCount,
+                Created = package.Created.ToNuGetShortDateString(),
                 Listed = package.Listed,
-                Deleted = package.PackageStatusKey == PackageStatus.Deleted,
+                PackageStatus = package.PackageStatusKey.ToString(),
+                Owners = package
+                    .PackageRegistration
+                    .Owners
+                    .Select(u => u.Username)
+                    .OrderBy(u => u)
+                    .Select(username => new UserViewModel
+                    {
+                        Username = username,
+                        ProfileUrl = Url.GetActionLink(
+                            nameof(UsersController.Profiles),
+                            "Users",
+                            relativeUrl: true,
+                            routeValues: new RouteValueDictionary
+                            {
+                                { "username", username },
+                                { "area", string.Empty },
+                            }),
+                    })
+                    .ToList()
             };
         }
     }
diff --git a/src/NuGetGallery/Areas/Admin/ViewModels/DeleteSearchResult.cs b/src/NuGetGallery/Areas/Admin/ViewModels/DeleteSearchResult.cs
index 74263a9eda..f9f6eeb573 100644
--- a/src/NuGetGallery/Areas/Admin/ViewModels/DeleteSearchResult.cs
+++ b/src/NuGetGallery/Areas/Admin/ViewModels/DeleteSearchResult.cs
@@ -1,6 +1,8 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
+using System.Collections.Generic;
+
 namespace NuGetGallery.Areas.Admin.ViewModels
 {
     public class DeleteSearchResult
@@ -8,7 +10,9 @@ public class DeleteSearchResult
         public string PackageId { get; set; }
         public string PackageVersionNormalized { get; set; }
         public int DownloadCount { get; set; }
+        public string Created { get; set; }
         public bool Listed { get; set; }
-        public bool Deleted { get; set; }
+        public string PackageStatus { get; set; }
+        public IReadOnlyList<UserViewModel> Owners { get; set; }
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/Areas/Admin/ViewModels/UserViewModel.cs b/src/NuGetGallery/Areas/Admin/ViewModels/UserViewModel.cs
new file mode 100644
index 0000000000..3eb78dcb56
--- /dev/null
+++ b/src/NuGetGallery/Areas/Admin/ViewModels/UserViewModel.cs
@@ -0,0 +1,11 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+namespace NuGetGallery.Areas.Admin.ViewModels
+{
+    public class UserViewModel
+    {
+        public string Username { get; set; }
+        public string ProfileUrl { get; set; }
+    }
+}
\ No newline at end of file
diff --git a/src/NuGetGallery/Areas/Admin/Views/Delete/Index.cshtml b/src/NuGetGallery/Areas/Admin/Views/Delete/Index.cshtml
index 73dc91bf89..31c5b09ace 100644
--- a/src/NuGetGallery/Areas/Admin/Views/Delete/Index.cshtml
+++ b/src/NuGetGallery/Areas/Admin/Views/Delete/Index.cshtml
@@ -17,14 +17,17 @@
 
         @using (Html.BeginForm("Delete", "Packages", new { area = "", id = Guid.NewGuid().ToString(), version = "99.99.99" }, FormMethod.Post, new {id = "delete-form"}))
         {
-            <table id="searchResults" class="sexy-table" style="display: none;" data-bind="visible: searchResults().length > 0">
+            <table id="searchResults" class="sexy-table" style="display: none" data-bind="visible: searchResults().length > 0">
                 <thead>
                 <tr>
                     <th><input type="checkbox" data-bind="click: toggleSelectAll, checked: selectAllState"/></th>
                     <th>Package</th>
                     <th>Version</th>
                     <th>Downloads</th>
+                    <th>Created</th>
                     <th>Listed?</th>
+                    <th>Status</th>
+                    <th>Owners</th>
                 </tr>
                 </thead>
                 <tbody data-bind="foreach: searchResults">
@@ -33,10 +36,18 @@
                         <td><a href="#" data-bind="text: PackageId, attr: { href: $parent.generatePackageUrl($data) }"></a></td>
                         <td><span data-bind="text: PackageVersionNormalized"></span></td>
                         <td><span data-bind="text: DownloadCount"></span></td>
+                        <td><span data-bind="text: Created"></span></td>
                         <td><span data-bind="text: Listed"></span></td>
+                        <td><span data-bind="text: PackageStatus"></span></td>
+                        <td data-bind="foreach: Owners">
+                            <a data-bind="text: Username, attr: { href: ProfileUrl }" />
+                        </td>
                     </tr>
                 </tbody>
             </table>
+            <div style="display: none" data-bind="visible: searchResults().length === 0 && doneSearching()">
+                <p>No packages found.</p>
+            </div>
 
             <div class="danger-zone" style="display: none;" data-bind="visible: arePackagesSelected">
                 <h2>Danger zone</h2>
@@ -104,8 +115,10 @@
                 var $self = this;
 
                 this.searchQuery = ko.observable('');
+                $self.doneSearching = ko.observable(false);
 
-                this.search = function() {
+                this.search = function () {
+                    $self.doneSearching = ko.observable(false);
                     $.ajax({
                             url: '@Url.Action("Search", "Delete", new {area = "Admin"})?query=' + encodeURIComponent($self.searchQuery()),
                             cache: false,
@@ -121,6 +134,9 @@
                         })
                         .error(function(jqXhr, textStatus, errorThrown) {
                             alert("Error: " + errorThrown);
+                        })
+                        .always(function () {
+                            $self.doneSearching(true);
                         });
                 };
 
diff --git a/src/NuGetGallery/NuGetGallery.csproj b/src/NuGetGallery/NuGetGallery.csproj
index 182a681a8c..c1039b1c3a 100644
--- a/src/NuGetGallery/NuGetGallery.csproj
+++ b/src/NuGetGallery/NuGetGallery.csproj
@@ -699,6 +699,7 @@
     <Compile Include="Areas\Admin\Services\PagerDutyClient.cs" />
     <Compile Include="Areas\Admin\Services\SupportRequestService.cs" />
     <Compile Include="Areas\Admin\ViewModels\DeleteSearchResult.cs" />
+    <Compile Include="Areas\Admin\ViewModels\UserViewModel.cs" />
     <Compile Include="Areas\Admin\ViewModels\ReservedNamespaceResultModel.cs" />
     <Compile Include="Areas\Admin\ViewModels\ReservedNamespaceViewModel.cs" />
     <Compile Include="Areas\Admin\ViewModels\ReservedNamespaceSearchResult.cs" />
diff --git a/src/NuGetGallery/Services/PackageDeleteService.cs b/src/NuGetGallery/Services/PackageDeleteService.cs
index e3994b8fc1..c270413063 100644
--- a/src/NuGetGallery/Services/PackageDeleteService.cs
+++ b/src/NuGetGallery/Services/PackageDeleteService.cs
@@ -201,6 +201,16 @@ private async Task BackupPackageBinaries(IEnumerable<Package> packages)
             // Backup the package binaries and remove from main storage
             foreach (var package in packages)
             {
+                // Backup the package from the "validating" container.
+                using (var packageStream = await _packageFileService.DownloadValidationPackageFileAsync(package))
+                {
+                    if (packageStream != null)
+                    {
+                        await _packageFileService.StorePackageFileInBackupLocationAsync(package, packageStream);
+                    }
+                }
+
+                // Backup the package from the "packages" container.
                 using (var packageStream = await _packageFileService.DownloadPackageFileAsync(package))
                 {
                     if (packageStream != null)
@@ -208,12 +218,14 @@ private async Task BackupPackageBinaries(IEnumerable<Package> packages)
                         await _packageFileService.StorePackageFileInBackupLocationAsync(package, packageStream);
                     }
                 }
+
                 var id = package.PackageRegistration.Id;
                 var version = string.IsNullOrEmpty(package.NormalizedVersion)
                             ? NuGetVersion.Parse(package.Version).ToNormalizedString()
                             : package.NormalizedVersion;
 
                 await _packageFileService.DeletePackageFileAsync(id, version);
+                await _packageFileService.DeleteValidationPackageFileAsync(id, version);
 
                 // Delete any active or pending readme files for this package.
                 await TryDeleteReadMeMdFile(package, false);
diff --git a/src/NuGetGallery/UrlExtensions.cs b/src/NuGetGallery/UrlExtensions.cs
index c61559973e..8032051777 100644
--- a/src/NuGetGallery/UrlExtensions.cs
+++ b/src/NuGetGallery/UrlExtensions.cs
@@ -831,8 +831,8 @@ internal static string EnsureTrailingSlash(string url)
             return url;
         }
 
-        private static string GetActionLink(
-            UrlHelper url,
+        public static string GetActionLink(
+            this UrlHelper url,
             string actionName,
             string controllerName,
             bool relativeUrl,
diff --git a/src/NuGetGallery/Web.config b/src/NuGetGallery/Web.config
index f25c119393..ea9e6100fc 100644
--- a/src/NuGetGallery/Web.config
+++ b/src/NuGetGallery/Web.config
@@ -24,25 +24,25 @@
     <!-- DEPLOYMENT SPECIFIC -->
     <!-- ******************* -->
     <!-- These should change on every deployment (to rotate credentials, etc.) -->
-    <add key="Gallery.StorageType" value="FileSystem" />
+    <add key="Gallery.StorageType" value="AzureStorage" />
     <!-- The storage type to use. Can be FileSystem (default) or AzureStorage -->
 
-    <add key="Gallery.AzureStorage.Auditing.ConnectionString" value="" />
-    <add key="Gallery.AzureStorage.Content.ConnectionString" value="" />
-    <add key="Gallery.AzureStorage.Errors.ConnectionString" value="" />
-    <add key="Gallery.AzureStorage.NuGetExe.ConnectionString" value="" />
-    <add key="Gallery.AzureStorage.Packages.ConnectionString" value="" />
-    <add key="Gallery.AzureStorage.Statistics.ConnectionString" value="" />
-    <add key="Gallery.AzureStorage.Uploads.ConnectionString" value="" />
+    <add key="Gallery.AzureStorage.Auditing.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
+    <add key="Gallery.AzureStorage.Content.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
+    <add key="Gallery.AzureStorage.Errors.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
+    <add key="Gallery.AzureStorage.NuGetExe.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
+    <add key="Gallery.AzureStorage.Packages.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
+    <add key="Gallery.AzureStorage.Statistics.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
+    <add key="Gallery.AzureStorage.Uploads.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
     <!-- The various Azure Storage connection strings to use. If the Gallery.StorageType is AzureStorage, all must be defined. -->
     
     <add key="Gallery.AzureStorageReadAccessGeoRedundant" value="false" />
     <!-- If the storage account has to fall-back to a secondary (when Read Access Geo Redundant is enabled in Azure storage), change Gallery.AzureStorageReadAccessGeoRedundant to true -->
 
-    <add key="Gallery.AsynchronousPackageValidationEnabled" value="false" />
+    <add key="Gallery.AsynchronousPackageValidationEnabled" value="true" />
     
-    <add key="AzureServiceBus.Validation.ConnectionString" value="" />
-    <add key="AzureServiceBus.Validation.TopicName" value="" />
+    <add key="AzureServiceBus.Validation.ConnectionString" value="Endpoint=sb://jver-test.servicebus.windows.net/;SharedAccessKeyName=Gallery;SharedAccessKey=Q9OqQ508PzAyFD/8UiIaEhoMWi4U1HbN+dhNplIRS9A=" />
+    <add key="AzureServiceBus.Validation.TopicName" value="validation" />
     <!--
     If Gallery.AsynchronousPackageValidationEnabled is true, both the AzureServiceBus.Validation.ConnectionString
     and AzureServiceBus.Validation.TopicName must be set.
diff --git a/tests/NuGetGallery.Facts/Areas/Admin/Controllers/DeleteControllerFacts.cs b/tests/NuGetGallery.Facts/Areas/Admin/Controllers/DeleteControllerFacts.cs
new file mode 100644
index 0000000000..1ecd04b1af
--- /dev/null
+++ b/tests/NuGetGallery.Facts/Areas/Admin/Controllers/DeleteControllerFacts.cs
@@ -0,0 +1,107 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Web;
+using System.Web.Mvc;
+using Moq;
+using NuGetGallery.Areas.Admin.ViewModels;
+using NuGetGallery.Framework;
+using Xunit;
+
+namespace NuGetGallery.Areas.Admin.Controllers
+{
+    public class DeleteControllerFacts
+    {
+        public class TheSearchMethod : FactsBase
+        {
+            [Fact]
+            public void DoesNotMakeDuplicateQueries()
+            {
+                // Arrange
+                _query = "NuGet.Versioning" + Environment.NewLine + "  NUGET.VERSIONING   ";
+
+                // Act
+                var result = _target.Search(_query);
+
+                // Assert
+                _packageService.Verify(
+                    x => x.FindPackageRegistrationById("NuGet.Versioning"),
+                    Times.Once);
+            }
+
+            [Fact]
+            public void DoesNotReturnDuplicatePackages()
+            {
+                // Arrange
+                _packages.Add(_packages[0]);
+
+                // Act
+                var result = _target.Search(_query);
+
+                // Assert
+                var jsonResult = Assert.IsType<JsonResult>(result);
+                var searchResults = Assert.IsType<List<DeleteSearchResult>>(jsonResult.Data);
+                var uniqueIdentities = searchResults.Select(p => $"{p.PackageId} {p.PackageVersionNormalized}").Distinct();
+                Assert.Equal(searchResults.Count, uniqueIdentities.Count());
+            }
+        }
+
+        public abstract class FactsBase : TestContainer
+        {
+            protected string _query;
+            protected readonly List<Package> _packages;
+            protected readonly Mock<IPackageService> _packageService;
+            protected readonly Mock<HttpContextBase> _httpContextBase;
+            protected readonly DeleteController _target;
+
+            public FactsBase()
+            {
+                _query = "NuGet.Versioning";
+                _packages = new List<Package>()
+                {
+                    new Package
+                    {
+                        Key = 2,
+                        PackageRegistration = new PackageRegistration
+                        {
+                            Id = "NuGet.Versioning",
+                            Owners = new[]
+                            {
+                                new User { Username = "microsoft" },
+                                new User { Username = "nuget" },
+                            }
+                        },
+                        NormalizedVersion = "4.4.0",
+                    },
+                    new Package
+                    {
+                        Key = 1,
+                        PackageRegistration = new PackageRegistration
+                        {
+                            Id = "NuGet.Versioning",
+                            Owners = new[]
+                            {
+                                new User { Username = "microsoft" },
+                                new User { Username = "nuget" },
+                            }
+                        },
+                        NormalizedVersion = "4.3.0",
+                    },
+                };
+
+                _packageService = new Mock<IPackageService>();
+                _packageService
+                    .Setup(x => x.FindPackageRegistrationById(It.IsAny<string>()))
+                    .Returns(() => new PackageRegistration { Packages = _packages });
+                _httpContextBase = new Mock<HttpContextBase>();
+
+                _target = new DeleteController(_packageService.Object);
+                
+                TestUtility.SetupHttpContextMockForUrlGeneration(_httpContextBase, _target);
+            }
+        }
+    }
+}
diff --git a/tests/NuGetGallery.Facts/Areas/Admin/Controllers/ReservedNamespaceControllerFacts.cs b/tests/NuGetGallery.Facts/Areas/Admin/Controllers/ReservedNamespaceControllerFacts.cs
index cfaf2619fb..1d0b80546a 100644
--- a/tests/NuGetGallery.Facts/Areas/Admin/Controllers/ReservedNamespaceControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Areas/Admin/Controllers/ReservedNamespaceControllerFacts.cs
@@ -4,13 +4,10 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
-using System.Threading.Tasks;
 using System.Web.Mvc;
-using Moq;
-using NuGetGallery.Security;
 using NuGetGallery.Areas.Admin.ViewModels;
-using Xunit;
 using NuGetGallery.TestUtils;
+using Xunit;
 
 namespace NuGetGallery.Areas.Admin.Controllers
 {
diff --git a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
index 85b392500a..792d892802 100644
--- a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
+++ b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
@@ -394,6 +394,7 @@
     <Compile Include="AppConfigIsCorrectlyApplied.cs" />
     <Compile Include="App_Start\StorageDependentFacts.cs" />
     <Compile Include="App_Start\RuntimeServiceProviderTests.cs" />
+    <Compile Include="Areas\Admin\Controllers\DeleteControllerFacts.cs" />
     <Compile Include="Areas\Admin\Controllers\ReservedNamespaceControllerFacts.cs" />
     <Compile Include="Areas\Admin\Controllers\SecurityPolicyControllerFacts.cs" />
     <Compile Include="Authentication\AuthenticatorFacts.cs" />
diff --git a/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
index d12de71933..6e0df18dcc 100644
--- a/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
@@ -190,14 +190,11 @@ public async Task WillUpdateTheIndexingService()
             }
 
             [Fact]
-            public async Task WillBackupAndDeleteThePackageFile()
+            public async Task WillBackupAndDeleteJustThePublicPackageFile()
             {
                 var packageFileService = new Mock<IPackageFileService>();
                 packageFileService.Setup(x => x.DownloadPackageFileAsync(It.IsAny<Package>()))
-                    .ReturnsAsync(new MemoryStream());
-                packageFileService.Setup(x => x.DeleteReadMeMdFileAsync(It.IsAny<Package>(), It.IsAny<bool>()))
-                    .Returns(Task.CompletedTask)
-                    .Verifiable();
+                    .ReturnsAsync(Stream.Null);
 
                 var service = CreateService(packageFileService: packageFileService);
                 var packageRegistration = new PackageRegistration();
@@ -207,9 +204,81 @@ public async Task WillBackupAndDeleteThePackageFile()
 
                 await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
 
-                packageFileService.Verify(x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()));
-                packageFileService.Verify(x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version));
+                packageFileService.Verify(
+                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
+                    Times.Once);
+                packageFileService.Verify(
+                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+            }
+
+            [Fact]
+            public async Task WillBackupAndDeleteJustTheValidationPackageFile()
+            {
+                var packageFileService = new Mock<IPackageFileService>();
+                packageFileService.Setup(x => x.DownloadValidationPackageFileAsync(It.IsAny<Package>()))
+                    .ReturnsAsync(Stream.Null);
+
+                var service = CreateService(packageFileService: packageFileService);
+                var packageRegistration = new PackageRegistration();
+                var package = new Package { PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
+                packageRegistration.Packages.Add(package);
+                var user = new User("test");
+
+                await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
+
+                packageFileService.Verify(
+                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
+                    Times.Once);
+                packageFileService.Verify(
+                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+                packageFileService.Verify(
+                    x => x.DeleteValidationPackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+            }
+
+            [Fact]
+            public async Task WillBackupAndDeleteBothThePublicAndValidationPackageFile()
+            {
+                var packageFileService = new Mock<IPackageFileService>();
+                packageFileService.Setup(x => x.DownloadPackageFileAsync(It.IsAny<Package>()))
+                    .ReturnsAsync(Stream.Null);
+                packageFileService.Setup(x => x.DownloadValidationPackageFileAsync(It.IsAny<Package>()))
+                    .ReturnsAsync(Stream.Null);
+
+                var service = CreateService(packageFileService: packageFileService);
+                var packageRegistration = new PackageRegistration();
+                var package = new Package { PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
+                packageRegistration.Packages.Add(package);
+                var user = new User("test");
+
+                await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
+
+                packageFileService.Verify(
+                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
+                    Times.Exactly(2));
+                packageFileService.Verify(
+                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+                packageFileService.Verify(
+                    x => x.DeleteValidationPackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+            }
+
+            [Fact]
+            public async Task WillDeleteReadMeFiles()
+            {
+                var packageFileService = new Mock<IPackageFileService>();
 
+                var service = CreateService(packageFileService: packageFileService);
+                var packageRegistration = new PackageRegistration();
+                var package = new Package { PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
+                packageRegistration.Packages.Add(package);
+                var user = new User("test");
+
+                await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
+                
                 packageFileService.Verify(x => x.DeleteReadMeMdFileAsync(package, true), Times.Once);
                 packageFileService.Verify(x => x.DeleteReadMeMdFileAsync(package, false), Times.Once);
             }
@@ -374,11 +443,11 @@ public async Task WillUpdateTheIndexingService()
             }
 
             [Fact]
-            public async Task WillBackupAndDeleteThePackageFile()
+            public async Task WillBackupAndDeleteJustThePublicPackageFile()
             {
                 var packageFileService = new Mock<IPackageFileService>();
                 packageFileService.Setup(x => x.DownloadPackageFileAsync(It.IsAny<Package>()))
-                    .ReturnsAsync(new MemoryStream());
+                    .ReturnsAsync(Stream.Null);
 
                 var service = CreateService(packageFileService: packageFileService);
                 var packageRegistration = new PackageRegistration();
@@ -388,8 +457,86 @@ public async Task WillBackupAndDeleteThePackageFile()
 
                 await service.HardDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty, false);
 
-                packageFileService.Verify(x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()));
-                packageFileService.Verify(x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version));
+                packageFileService.Verify(
+                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
+                    Times.Once);
+                packageFileService.Verify(
+                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+                packageFileService.Verify(
+                    x => x.DeleteValidationPackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+            }
+
+            [Fact]
+            public async Task WillBackupAndDeleteJustTheValidationPackageFile()
+            {
+                var packageFileService = new Mock<IPackageFileService>();
+                packageFileService.Setup(x => x.DownloadValidationPackageFileAsync(It.IsAny<Package>()))
+                    .ReturnsAsync(Stream.Null);
+
+                var service = CreateService(packageFileService: packageFileService);
+                var packageRegistration = new PackageRegistration();
+                var package = new Package { Key = 123, PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
+                packageRegistration.Packages.Add(package);
+                var user = new User("test");
+
+                await service.HardDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty, false);
+
+                packageFileService.Verify(
+                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
+                    Times.Once);
+                packageFileService.Verify(
+                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+                packageFileService.Verify(
+                    x => x.DeleteValidationPackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+            }
+
+            [Fact]
+            public async Task WillBackupAndDeleteBothThePublicAndValidationPackageFile()
+            {
+                var packageFileService = new Mock<IPackageFileService>();
+                packageFileService.Setup(x => x.DownloadPackageFileAsync(It.IsAny<Package>()))
+                    .ReturnsAsync(Stream.Null);
+                packageFileService.Setup(x => x.DownloadValidationPackageFileAsync(It.IsAny<Package>()))
+                    .ReturnsAsync(Stream.Null);
+
+                var service = CreateService(packageFileService: packageFileService);
+                var packageRegistration = new PackageRegistration();
+                var package = new Package { Key = 123, PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
+                packageRegistration.Packages.Add(package);
+                var user = new User("test");
+
+                await service.HardDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty, false);
+
+                packageFileService.Verify(
+                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
+                    Times.Exactly(2));
+                packageFileService.Verify(
+                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+                packageFileService.Verify(
+                    x => x.DeleteValidationPackageFileAsync(package.PackageRegistration.Id, package.Version),
+                    Times.Once);
+            }
+
+            [Fact]
+            public async Task WillDeleteReadMeFiles()
+            {
+                var packageFileService = new Mock<IPackageFileService>();
+
+                var service = CreateService(packageFileService: packageFileService);
+                var packageRegistration = new PackageRegistration();
+                var package = new Package { Key = 123, PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
+                packageRegistration.Packages.Add(package);
+                var user = new User("test");
+
+                await service.HardDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty, false);
+
+                packageFileService.Verify(x => x.DeleteReadMeMdFileAsync(package, true), Times.Once);
+                packageFileService.Verify(x => x.DeleteReadMeMdFileAsync(package, false), Times.Once);
             }
 
             [Fact]

From 9952176f7b356d87edcbf85f50be385a5e676635 Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Thu, 28 Sep 2017 14:34:47 -0700
Subject: [PATCH 24/25] HIDE!!!

---
 src/NuGetGallery/Web.config | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/NuGetGallery/Web.config b/src/NuGetGallery/Web.config
index ea9e6100fc..f25c119393 100644
--- a/src/NuGetGallery/Web.config
+++ b/src/NuGetGallery/Web.config
@@ -24,25 +24,25 @@
     <!-- DEPLOYMENT SPECIFIC -->
     <!-- ******************* -->
     <!-- These should change on every deployment (to rotate credentials, etc.) -->
-    <add key="Gallery.StorageType" value="AzureStorage" />
+    <add key="Gallery.StorageType" value="FileSystem" />
     <!-- The storage type to use. Can be FileSystem (default) or AzureStorage -->
 
-    <add key="Gallery.AzureStorage.Auditing.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
-    <add key="Gallery.AzureStorage.Content.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
-    <add key="Gallery.AzureStorage.Errors.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
-    <add key="Gallery.AzureStorage.NuGetExe.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
-    <add key="Gallery.AzureStorage.Packages.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
-    <add key="Gallery.AzureStorage.Statistics.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
-    <add key="Gallery.AzureStorage.Uploads.ConnectionString" value="DefaultEndpointsProtocol=https;AccountName=jverstorage;AccountKey=zYSWNSggI9gDC7uVhUzaE3jzlCR3dVCIeCVL/hcn/n4zN5Zmp1aM75Qq9/7uOEvWww/y101ERX1ksLnKuLTG+w==;EndpointSuffix=core.windows.net" />
+    <add key="Gallery.AzureStorage.Auditing.ConnectionString" value="" />
+    <add key="Gallery.AzureStorage.Content.ConnectionString" value="" />
+    <add key="Gallery.AzureStorage.Errors.ConnectionString" value="" />
+    <add key="Gallery.AzureStorage.NuGetExe.ConnectionString" value="" />
+    <add key="Gallery.AzureStorage.Packages.ConnectionString" value="" />
+    <add key="Gallery.AzureStorage.Statistics.ConnectionString" value="" />
+    <add key="Gallery.AzureStorage.Uploads.ConnectionString" value="" />
     <!-- The various Azure Storage connection strings to use. If the Gallery.StorageType is AzureStorage, all must be defined. -->
     
     <add key="Gallery.AzureStorageReadAccessGeoRedundant" value="false" />
     <!-- If the storage account has to fall-back to a secondary (when Read Access Geo Redundant is enabled in Azure storage), change Gallery.AzureStorageReadAccessGeoRedundant to true -->
 
-    <add key="Gallery.AsynchronousPackageValidationEnabled" value="true" />
+    <add key="Gallery.AsynchronousPackageValidationEnabled" value="false" />
     
-    <add key="AzureServiceBus.Validation.ConnectionString" value="Endpoint=sb://jver-test.servicebus.windows.net/;SharedAccessKeyName=Gallery;SharedAccessKey=Q9OqQ508PzAyFD/8UiIaEhoMWi4U1HbN+dhNplIRS9A=" />
-    <add key="AzureServiceBus.Validation.TopicName" value="validation" />
+    <add key="AzureServiceBus.Validation.ConnectionString" value="" />
+    <add key="AzureServiceBus.Validation.TopicName" value="" />
     <!--
     If Gallery.AsynchronousPackageValidationEnabled is true, both the AzureServiceBus.Validation.ConnectionString
     and AzureServiceBus.Validation.TopicName must be set.

From 5c85f1011f3d1947e1356fa53138be6d9af33886 Mon Sep 17 00:00:00 2001
From: Joel Verhagen <jver@microsoft.com>
Date: Thu, 28 Sep 2017 14:52:18 -0700
Subject: [PATCH 25/25] Revert "Backup package in validation package container
 during delete flow (and other little fixes) (#4773)"

This reverts commit c882e083cabd860a8c3700ed676b723a24c1bc32.
---
 .../Admin/Controllers/DeleteController.cs     |  51 +-----
 .../Admin/ViewModels/DeleteSearchResult.cs    |   6 +-
 .../Areas/Admin/ViewModels/UserViewModel.cs   |  11 --
 .../Areas/Admin/Views/Delete/Index.cshtml     |  20 +--
 src/NuGetGallery/NuGetGallery.csproj          |   1 -
 .../Services/PackageDeleteService.cs          |  12 --
 src/NuGetGallery/UrlExtensions.cs             |   4 +-
 .../Controllers/DeleteControllerFacts.cs      | 107 -----------
 .../ReservedNamespaceControllerFacts.cs       |   5 +-
 .../NuGetGallery.Facts.csproj                 |   1 -
 .../Services/PackageDeleteServiceFacts.cs     | 169 ++----------------
 11 files changed, 24 insertions(+), 363 deletions(-)
 delete mode 100644 src/NuGetGallery/Areas/Admin/ViewModels/UserViewModel.cs
 delete mode 100644 tests/NuGetGallery.Facts/Areas/Admin/Controllers/DeleteControllerFacts.cs

diff --git a/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs b/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs
index 0e9ea94e52..aab78a5a94 100644
--- a/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs
+++ b/src/NuGetGallery/Areas/Admin/Controllers/DeleteController.cs
@@ -5,7 +5,6 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Web.Mvc;
-using System.Web.Routing;
 using NuGet.Versioning;
 using NuGetGallery.Areas.Admin.ViewModels;
 
@@ -50,25 +49,16 @@ public virtual ActionResult Search(string query)
 
             var queryParts = query.Split(new[] { ',', '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries);
 
-            var packages = new List<Package>();
-            var completedQueryParts = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+            var results = new List<DeleteSearchResult>();
             foreach (var queryPart in queryParts)
             {
-                // Don't make the same query twice.
-                if (!completedQueryParts.Add(queryPart.Trim()))
-                {
-                    continue;
-                }
-
                 var splitQueryPart = queryPart.Split(new[] {' '}, StringSplitOptions.RemoveEmptyEntries);
                 if (splitQueryPart.Length == 1)
                 {
                     var resultingRegistration = _packageService.FindPackageRegistrationById(splitQueryPart[0].Trim());
                     if (resultingRegistration != null)
                     {
-                        packages.AddRange(resultingRegistration
-                            .Packages
-                            .OrderBy(p => NuGetVersion.Parse(p.NormalizedVersion)));
+                        results.AddRange(resultingRegistration.Packages.Select(CreateDeleteSearchResult));
                     }
                 }
                 else if (splitQueryPart.Length == 2)
@@ -76,23 +66,10 @@ public virtual ActionResult Search(string query)
                     var resultingPackage = _packageService.FindPackageByIdAndVersionStrict(splitQueryPart[0].Trim(), splitQueryPart[1].Trim());
                     if (resultingPackage != null)
                     {
-                        packages.Add(resultingPackage);
+                        results.Add(CreateDeleteSearchResult(resultingPackage));
                     }
                 }
             }
-
-            // Filter out duplicate packages and create the view model.
-            var uniquePackagesKeys = new HashSet<int>();
-            var results = new List<DeleteSearchResult>();
-            foreach (var package in packages)
-            {
-                if (!uniquePackagesKeys.Add(package.Key))
-                {
-                    continue;
-                }
-
-                results.Add(CreateDeleteSearchResult(package));
-            }
             
             return Json(results, JsonRequestBehavior.AllowGet);
         }
@@ -106,28 +83,8 @@ private DeleteSearchResult CreateDeleteSearchResult(Package package)
                     ? package.NormalizedVersion 
                     : NuGetVersion.Parse(package.Version).ToNormalizedString(),
                 DownloadCount = package.DownloadCount,
-                Created = package.Created.ToNuGetShortDateString(),
                 Listed = package.Listed,
-                PackageStatus = package.PackageStatusKey.ToString(),
-                Owners = package
-                    .PackageRegistration
-                    .Owners
-                    .Select(u => u.Username)
-                    .OrderBy(u => u)
-                    .Select(username => new UserViewModel
-                    {
-                        Username = username,
-                        ProfileUrl = Url.GetActionLink(
-                            nameof(UsersController.Profiles),
-                            "Users",
-                            relativeUrl: true,
-                            routeValues: new RouteValueDictionary
-                            {
-                                { "username", username },
-                                { "area", string.Empty },
-                            }),
-                    })
-                    .ToList()
+                Deleted = package.PackageStatusKey == PackageStatus.Deleted,
             };
         }
     }
diff --git a/src/NuGetGallery/Areas/Admin/ViewModels/DeleteSearchResult.cs b/src/NuGetGallery/Areas/Admin/ViewModels/DeleteSearchResult.cs
index f9f6eeb573..74263a9eda 100644
--- a/src/NuGetGallery/Areas/Admin/ViewModels/DeleteSearchResult.cs
+++ b/src/NuGetGallery/Areas/Admin/ViewModels/DeleteSearchResult.cs
@@ -1,8 +1,6 @@
 // Copyright (c) .NET Foundation. All rights reserved.
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
-using System.Collections.Generic;
-
 namespace NuGetGallery.Areas.Admin.ViewModels
 {
     public class DeleteSearchResult
@@ -10,9 +8,7 @@ public class DeleteSearchResult
         public string PackageId { get; set; }
         public string PackageVersionNormalized { get; set; }
         public int DownloadCount { get; set; }
-        public string Created { get; set; }
         public bool Listed { get; set; }
-        public string PackageStatus { get; set; }
-        public IReadOnlyList<UserViewModel> Owners { get; set; }
+        public bool Deleted { get; set; }
     }
 }
\ No newline at end of file
diff --git a/src/NuGetGallery/Areas/Admin/ViewModels/UserViewModel.cs b/src/NuGetGallery/Areas/Admin/ViewModels/UserViewModel.cs
deleted file mode 100644
index 3eb78dcb56..0000000000
--- a/src/NuGetGallery/Areas/Admin/ViewModels/UserViewModel.cs
+++ /dev/null
@@ -1,11 +0,0 @@
-// Copyright (c) .NET Foundation. All rights reserved.
-// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
-
-namespace NuGetGallery.Areas.Admin.ViewModels
-{
-    public class UserViewModel
-    {
-        public string Username { get; set; }
-        public string ProfileUrl { get; set; }
-    }
-}
\ No newline at end of file
diff --git a/src/NuGetGallery/Areas/Admin/Views/Delete/Index.cshtml b/src/NuGetGallery/Areas/Admin/Views/Delete/Index.cshtml
index 31c5b09ace..73dc91bf89 100644
--- a/src/NuGetGallery/Areas/Admin/Views/Delete/Index.cshtml
+++ b/src/NuGetGallery/Areas/Admin/Views/Delete/Index.cshtml
@@ -17,17 +17,14 @@
 
         @using (Html.BeginForm("Delete", "Packages", new { area = "", id = Guid.NewGuid().ToString(), version = "99.99.99" }, FormMethod.Post, new {id = "delete-form"}))
         {
-            <table id="searchResults" class="sexy-table" style="display: none" data-bind="visible: searchResults().length > 0">
+            <table id="searchResults" class="sexy-table" style="display: none;" data-bind="visible: searchResults().length > 0">
                 <thead>
                 <tr>
                     <th><input type="checkbox" data-bind="click: toggleSelectAll, checked: selectAllState"/></th>
                     <th>Package</th>
                     <th>Version</th>
                     <th>Downloads</th>
-                    <th>Created</th>
                     <th>Listed?</th>
-                    <th>Status</th>
-                    <th>Owners</th>
                 </tr>
                 </thead>
                 <tbody data-bind="foreach: searchResults">
@@ -36,18 +33,10 @@
                         <td><a href="#" data-bind="text: PackageId, attr: { href: $parent.generatePackageUrl($data) }"></a></td>
                         <td><span data-bind="text: PackageVersionNormalized"></span></td>
                         <td><span data-bind="text: DownloadCount"></span></td>
-                        <td><span data-bind="text: Created"></span></td>
                         <td><span data-bind="text: Listed"></span></td>
-                        <td><span data-bind="text: PackageStatus"></span></td>
-                        <td data-bind="foreach: Owners">
-                            <a data-bind="text: Username, attr: { href: ProfileUrl }" />
-                        </td>
                     </tr>
                 </tbody>
             </table>
-            <div style="display: none" data-bind="visible: searchResults().length === 0 && doneSearching()">
-                <p>No packages found.</p>
-            </div>
 
             <div class="danger-zone" style="display: none;" data-bind="visible: arePackagesSelected">
                 <h2>Danger zone</h2>
@@ -115,10 +104,8 @@
                 var $self = this;
 
                 this.searchQuery = ko.observable('');
-                $self.doneSearching = ko.observable(false);
 
-                this.search = function () {
-                    $self.doneSearching = ko.observable(false);
+                this.search = function() {
                     $.ajax({
                             url: '@Url.Action("Search", "Delete", new {area = "Admin"})?query=' + encodeURIComponent($self.searchQuery()),
                             cache: false,
@@ -134,9 +121,6 @@
                         })
                         .error(function(jqXhr, textStatus, errorThrown) {
                             alert("Error: " + errorThrown);
-                        })
-                        .always(function () {
-                            $self.doneSearching(true);
                         });
                 };
 
diff --git a/src/NuGetGallery/NuGetGallery.csproj b/src/NuGetGallery/NuGetGallery.csproj
index c1039b1c3a..182a681a8c 100644
--- a/src/NuGetGallery/NuGetGallery.csproj
+++ b/src/NuGetGallery/NuGetGallery.csproj
@@ -699,7 +699,6 @@
     <Compile Include="Areas\Admin\Services\PagerDutyClient.cs" />
     <Compile Include="Areas\Admin\Services\SupportRequestService.cs" />
     <Compile Include="Areas\Admin\ViewModels\DeleteSearchResult.cs" />
-    <Compile Include="Areas\Admin\ViewModels\UserViewModel.cs" />
     <Compile Include="Areas\Admin\ViewModels\ReservedNamespaceResultModel.cs" />
     <Compile Include="Areas\Admin\ViewModels\ReservedNamespaceViewModel.cs" />
     <Compile Include="Areas\Admin\ViewModels\ReservedNamespaceSearchResult.cs" />
diff --git a/src/NuGetGallery/Services/PackageDeleteService.cs b/src/NuGetGallery/Services/PackageDeleteService.cs
index c270413063..e3994b8fc1 100644
--- a/src/NuGetGallery/Services/PackageDeleteService.cs
+++ b/src/NuGetGallery/Services/PackageDeleteService.cs
@@ -201,16 +201,6 @@ private async Task BackupPackageBinaries(IEnumerable<Package> packages)
             // Backup the package binaries and remove from main storage
             foreach (var package in packages)
             {
-                // Backup the package from the "validating" container.
-                using (var packageStream = await _packageFileService.DownloadValidationPackageFileAsync(package))
-                {
-                    if (packageStream != null)
-                    {
-                        await _packageFileService.StorePackageFileInBackupLocationAsync(package, packageStream);
-                    }
-                }
-
-                // Backup the package from the "packages" container.
                 using (var packageStream = await _packageFileService.DownloadPackageFileAsync(package))
                 {
                     if (packageStream != null)
@@ -218,14 +208,12 @@ private async Task BackupPackageBinaries(IEnumerable<Package> packages)
                         await _packageFileService.StorePackageFileInBackupLocationAsync(package, packageStream);
                     }
                 }
-
                 var id = package.PackageRegistration.Id;
                 var version = string.IsNullOrEmpty(package.NormalizedVersion)
                             ? NuGetVersion.Parse(package.Version).ToNormalizedString()
                             : package.NormalizedVersion;
 
                 await _packageFileService.DeletePackageFileAsync(id, version);
-                await _packageFileService.DeleteValidationPackageFileAsync(id, version);
 
                 // Delete any active or pending readme files for this package.
                 await TryDeleteReadMeMdFile(package, false);
diff --git a/src/NuGetGallery/UrlExtensions.cs b/src/NuGetGallery/UrlExtensions.cs
index 8032051777..c61559973e 100644
--- a/src/NuGetGallery/UrlExtensions.cs
+++ b/src/NuGetGallery/UrlExtensions.cs
@@ -831,8 +831,8 @@ internal static string EnsureTrailingSlash(string url)
             return url;
         }
 
-        public static string GetActionLink(
-            this UrlHelper url,
+        private static string GetActionLink(
+            UrlHelper url,
             string actionName,
             string controllerName,
             bool relativeUrl,
diff --git a/tests/NuGetGallery.Facts/Areas/Admin/Controllers/DeleteControllerFacts.cs b/tests/NuGetGallery.Facts/Areas/Admin/Controllers/DeleteControllerFacts.cs
deleted file mode 100644
index 1ecd04b1af..0000000000
--- a/tests/NuGetGallery.Facts/Areas/Admin/Controllers/DeleteControllerFacts.cs
+++ /dev/null
@@ -1,107 +0,0 @@
-// Copyright (c) .NET Foundation. All rights reserved.
-// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
-
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Web;
-using System.Web.Mvc;
-using Moq;
-using NuGetGallery.Areas.Admin.ViewModels;
-using NuGetGallery.Framework;
-using Xunit;
-
-namespace NuGetGallery.Areas.Admin.Controllers
-{
-    public class DeleteControllerFacts
-    {
-        public class TheSearchMethod : FactsBase
-        {
-            [Fact]
-            public void DoesNotMakeDuplicateQueries()
-            {
-                // Arrange
-                _query = "NuGet.Versioning" + Environment.NewLine + "  NUGET.VERSIONING   ";
-
-                // Act
-                var result = _target.Search(_query);
-
-                // Assert
-                _packageService.Verify(
-                    x => x.FindPackageRegistrationById("NuGet.Versioning"),
-                    Times.Once);
-            }
-
-            [Fact]
-            public void DoesNotReturnDuplicatePackages()
-            {
-                // Arrange
-                _packages.Add(_packages[0]);
-
-                // Act
-                var result = _target.Search(_query);
-
-                // Assert
-                var jsonResult = Assert.IsType<JsonResult>(result);
-                var searchResults = Assert.IsType<List<DeleteSearchResult>>(jsonResult.Data);
-                var uniqueIdentities = searchResults.Select(p => $"{p.PackageId} {p.PackageVersionNormalized}").Distinct();
-                Assert.Equal(searchResults.Count, uniqueIdentities.Count());
-            }
-        }
-
-        public abstract class FactsBase : TestContainer
-        {
-            protected string _query;
-            protected readonly List<Package> _packages;
-            protected readonly Mock<IPackageService> _packageService;
-            protected readonly Mock<HttpContextBase> _httpContextBase;
-            protected readonly DeleteController _target;
-
-            public FactsBase()
-            {
-                _query = "NuGet.Versioning";
-                _packages = new List<Package>()
-                {
-                    new Package
-                    {
-                        Key = 2,
-                        PackageRegistration = new PackageRegistration
-                        {
-                            Id = "NuGet.Versioning",
-                            Owners = new[]
-                            {
-                                new User { Username = "microsoft" },
-                                new User { Username = "nuget" },
-                            }
-                        },
-                        NormalizedVersion = "4.4.0",
-                    },
-                    new Package
-                    {
-                        Key = 1,
-                        PackageRegistration = new PackageRegistration
-                        {
-                            Id = "NuGet.Versioning",
-                            Owners = new[]
-                            {
-                                new User { Username = "microsoft" },
-                                new User { Username = "nuget" },
-                            }
-                        },
-                        NormalizedVersion = "4.3.0",
-                    },
-                };
-
-                _packageService = new Mock<IPackageService>();
-                _packageService
-                    .Setup(x => x.FindPackageRegistrationById(It.IsAny<string>()))
-                    .Returns(() => new PackageRegistration { Packages = _packages });
-                _httpContextBase = new Mock<HttpContextBase>();
-
-                _target = new DeleteController(_packageService.Object);
-                
-                TestUtility.SetupHttpContextMockForUrlGeneration(_httpContextBase, _target);
-            }
-        }
-    }
-}
diff --git a/tests/NuGetGallery.Facts/Areas/Admin/Controllers/ReservedNamespaceControllerFacts.cs b/tests/NuGetGallery.Facts/Areas/Admin/Controllers/ReservedNamespaceControllerFacts.cs
index 1d0b80546a..cfaf2619fb 100644
--- a/tests/NuGetGallery.Facts/Areas/Admin/Controllers/ReservedNamespaceControllerFacts.cs
+++ b/tests/NuGetGallery.Facts/Areas/Admin/Controllers/ReservedNamespaceControllerFacts.cs
@@ -4,10 +4,13 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
+using System.Threading.Tasks;
 using System.Web.Mvc;
+using Moq;
+using NuGetGallery.Security;
 using NuGetGallery.Areas.Admin.ViewModels;
-using NuGetGallery.TestUtils;
 using Xunit;
+using NuGetGallery.TestUtils;
 
 namespace NuGetGallery.Areas.Admin.Controllers
 {
diff --git a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
index 792d892802..85b392500a 100644
--- a/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
+++ b/tests/NuGetGallery.Facts/NuGetGallery.Facts.csproj
@@ -394,7 +394,6 @@
     <Compile Include="AppConfigIsCorrectlyApplied.cs" />
     <Compile Include="App_Start\StorageDependentFacts.cs" />
     <Compile Include="App_Start\RuntimeServiceProviderTests.cs" />
-    <Compile Include="Areas\Admin\Controllers\DeleteControllerFacts.cs" />
     <Compile Include="Areas\Admin\Controllers\ReservedNamespaceControllerFacts.cs" />
     <Compile Include="Areas\Admin\Controllers\SecurityPolicyControllerFacts.cs" />
     <Compile Include="Authentication\AuthenticatorFacts.cs" />
diff --git a/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs b/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
index 6e0df18dcc..d12de71933 100644
--- a/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
+++ b/tests/NuGetGallery.Facts/Services/PackageDeleteServiceFacts.cs
@@ -190,11 +190,14 @@ public async Task WillUpdateTheIndexingService()
             }
 
             [Fact]
-            public async Task WillBackupAndDeleteJustThePublicPackageFile()
+            public async Task WillBackupAndDeleteThePackageFile()
             {
                 var packageFileService = new Mock<IPackageFileService>();
                 packageFileService.Setup(x => x.DownloadPackageFileAsync(It.IsAny<Package>()))
-                    .ReturnsAsync(Stream.Null);
+                    .ReturnsAsync(new MemoryStream());
+                packageFileService.Setup(x => x.DeleteReadMeMdFileAsync(It.IsAny<Package>(), It.IsAny<bool>()))
+                    .Returns(Task.CompletedTask)
+                    .Verifiable();
 
                 var service = CreateService(packageFileService: packageFileService);
                 var packageRegistration = new PackageRegistration();
@@ -204,81 +207,9 @@ public async Task WillBackupAndDeleteJustThePublicPackageFile()
 
                 await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
 
-                packageFileService.Verify(
-                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
-                    Times.Once);
-                packageFileService.Verify(
-                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-            }
-
-            [Fact]
-            public async Task WillBackupAndDeleteJustTheValidationPackageFile()
-            {
-                var packageFileService = new Mock<IPackageFileService>();
-                packageFileService.Setup(x => x.DownloadValidationPackageFileAsync(It.IsAny<Package>()))
-                    .ReturnsAsync(Stream.Null);
-
-                var service = CreateService(packageFileService: packageFileService);
-                var packageRegistration = new PackageRegistration();
-                var package = new Package { PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
-                packageRegistration.Packages.Add(package);
-                var user = new User("test");
-
-                await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
-
-                packageFileService.Verify(
-                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
-                    Times.Once);
-                packageFileService.Verify(
-                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-                packageFileService.Verify(
-                    x => x.DeleteValidationPackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-            }
-
-            [Fact]
-            public async Task WillBackupAndDeleteBothThePublicAndValidationPackageFile()
-            {
-                var packageFileService = new Mock<IPackageFileService>();
-                packageFileService.Setup(x => x.DownloadPackageFileAsync(It.IsAny<Package>()))
-                    .ReturnsAsync(Stream.Null);
-                packageFileService.Setup(x => x.DownloadValidationPackageFileAsync(It.IsAny<Package>()))
-                    .ReturnsAsync(Stream.Null);
-
-                var service = CreateService(packageFileService: packageFileService);
-                var packageRegistration = new PackageRegistration();
-                var package = new Package { PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
-                packageRegistration.Packages.Add(package);
-                var user = new User("test");
-
-                await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
-
-                packageFileService.Verify(
-                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
-                    Times.Exactly(2));
-                packageFileService.Verify(
-                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-                packageFileService.Verify(
-                    x => x.DeleteValidationPackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-            }
-
-            [Fact]
-            public async Task WillDeleteReadMeFiles()
-            {
-                var packageFileService = new Mock<IPackageFileService>();
+                packageFileService.Verify(x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()));
+                packageFileService.Verify(x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version));
 
-                var service = CreateService(packageFileService: packageFileService);
-                var packageRegistration = new PackageRegistration();
-                var package = new Package { PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
-                packageRegistration.Packages.Add(package);
-                var user = new User("test");
-
-                await service.SoftDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty);
-                
                 packageFileService.Verify(x => x.DeleteReadMeMdFileAsync(package, true), Times.Once);
                 packageFileService.Verify(x => x.DeleteReadMeMdFileAsync(package, false), Times.Once);
             }
@@ -443,11 +374,11 @@ public async Task WillUpdateTheIndexingService()
             }
 
             [Fact]
-            public async Task WillBackupAndDeleteJustThePublicPackageFile()
+            public async Task WillBackupAndDeleteThePackageFile()
             {
                 var packageFileService = new Mock<IPackageFileService>();
                 packageFileService.Setup(x => x.DownloadPackageFileAsync(It.IsAny<Package>()))
-                    .ReturnsAsync(Stream.Null);
+                    .ReturnsAsync(new MemoryStream());
 
                 var service = CreateService(packageFileService: packageFileService);
                 var packageRegistration = new PackageRegistration();
@@ -457,86 +388,8 @@ public async Task WillBackupAndDeleteJustThePublicPackageFile()
 
                 await service.HardDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty, false);
 
-                packageFileService.Verify(
-                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
-                    Times.Once);
-                packageFileService.Verify(
-                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-                packageFileService.Verify(
-                    x => x.DeleteValidationPackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-            }
-
-            [Fact]
-            public async Task WillBackupAndDeleteJustTheValidationPackageFile()
-            {
-                var packageFileService = new Mock<IPackageFileService>();
-                packageFileService.Setup(x => x.DownloadValidationPackageFileAsync(It.IsAny<Package>()))
-                    .ReturnsAsync(Stream.Null);
-
-                var service = CreateService(packageFileService: packageFileService);
-                var packageRegistration = new PackageRegistration();
-                var package = new Package { Key = 123, PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
-                packageRegistration.Packages.Add(package);
-                var user = new User("test");
-
-                await service.HardDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty, false);
-
-                packageFileService.Verify(
-                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
-                    Times.Once);
-                packageFileService.Verify(
-                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-                packageFileService.Verify(
-                    x => x.DeleteValidationPackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-            }
-
-            [Fact]
-            public async Task WillBackupAndDeleteBothThePublicAndValidationPackageFile()
-            {
-                var packageFileService = new Mock<IPackageFileService>();
-                packageFileService.Setup(x => x.DownloadPackageFileAsync(It.IsAny<Package>()))
-                    .ReturnsAsync(Stream.Null);
-                packageFileService.Setup(x => x.DownloadValidationPackageFileAsync(It.IsAny<Package>()))
-                    .ReturnsAsync(Stream.Null);
-
-                var service = CreateService(packageFileService: packageFileService);
-                var packageRegistration = new PackageRegistration();
-                var package = new Package { Key = 123, PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
-                packageRegistration.Packages.Add(package);
-                var user = new User("test");
-
-                await service.HardDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty, false);
-
-                packageFileService.Verify(
-                    x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()),
-                    Times.Exactly(2));
-                packageFileService.Verify(
-                    x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-                packageFileService.Verify(
-                    x => x.DeleteValidationPackageFileAsync(package.PackageRegistration.Id, package.Version),
-                    Times.Once);
-            }
-
-            [Fact]
-            public async Task WillDeleteReadMeFiles()
-            {
-                var packageFileService = new Mock<IPackageFileService>();
-
-                var service = CreateService(packageFileService: packageFileService);
-                var packageRegistration = new PackageRegistration();
-                var package = new Package { Key = 123, PackageRegistration = packageRegistration, Version = "1.0.0", Hash = _packageHashForTests };
-                packageRegistration.Packages.Add(package);
-                var user = new User("test");
-
-                await service.HardDeletePackagesAsync(new[] { package }, user, string.Empty, string.Empty, false);
-
-                packageFileService.Verify(x => x.DeleteReadMeMdFileAsync(package, true), Times.Once);
-                packageFileService.Verify(x => x.DeleteReadMeMdFileAsync(package, false), Times.Once);
+                packageFileService.Verify(x => x.StorePackageFileInBackupLocationAsync(package, It.IsAny<Stream>()));
+                packageFileService.Verify(x => x.DeletePackageFileAsync(package.PackageRegistration.Id, package.Version));
             }
 
             [Fact]